Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
20/04/2026, 18:36
General
- Target 2026-04-20_d3d18ac6c8267d53b072f844bfd6a774_elex_wannacry.exe
- Size 60KB
- Sample260420-w875vset7s
- SHA256 58f968ed8634b93e1b4ecd9b4a96d179807137c18fcf79cb296bd83da6c508b5
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Detects Windows executables referencing non-Windows User-Agents 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-20_d3d18ac6c8267d53b072f844bfd6a774_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-20_d3d18ac6c8267d53b072f844bfd6a774_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D25BDD00-B0CD-44bb-B100-E5FE7B4C8DE8}.exeC:\Windows\{D25BDD00-B0CD-44bb-B100-E5FE7B4C8DE8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAC117F6-9007-4455-A0F5-399D5C35FA80}.exeC:\Windows\{CAC117F6-9007-4455-A0F5-399D5C35FA80}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{087D961A-007F-409b-ACD8-B199D6CF5026}.exeC:\Windows\{087D961A-007F-409b-ACD8-B199D6CF5026}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93F6ADFB-72BC-4842-807D-5136C4D59B0D}.exeC:\Windows\{93F6ADFB-72BC-4842-807D-5136C4D59B0D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C8E4AA0-2CAE-41ce-AD11-6DE3C32A2616}.exeC:\Windows\{2C8E4AA0-2CAE-41ce-AD11-6DE3C32A2616}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8F3A489E-8B56-4849-9392-51D9C0A0A13D}.exeC:\Windows\{8F3A489E-8B56-4849-9392-51D9C0A0A13D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7FDE4CE0-0C38-4cd3-A971-3271273A9049}.exeC:\Windows\{7FDE4CE0-0C38-4cd3-A971-3271273A9049}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74BA0123-157F-4096-82CE-3C9AFEEA5562}.exeC:\Windows\{74BA0123-157F-4096-82CE-3C9AFEEA5562}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B11B7ECF-D2C4-4d3b-A9C4-F95E7BED7428}.exeC:\Windows\{B11B7ECF-D2C4-4d3b-A9C4-F95E7BED7428}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF67E7FA-CE53-4400-B8BD-1A68E99CB455}.exeC:\Windows\{DF67E7FA-CE53-4400-B8BD-1A68E99CB455}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B11B7~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74BA0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7FDE4~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8F3A4~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C8E4~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93F6A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{087D9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAC11~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D25BD~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{087D961A-007F-409b-ACD8-B199D6CF5026}.exe
{2C8E4AA0-2CAE-41ce-AD11-6DE3C32A2616}.exe
{74BA0123-157F-4096-82CE-3C9AFEEA5562}.exe
{7FDE4CE0-0C38-4cd3-A971-3271273A9049}.exe
{8F3A489E-8B56-4849-9392-51D9C0A0A13D}.exe
{93F6ADFB-72BC-4842-807D-5136C4D59B0D}.exe
{B11B7ECF-D2C4-4d3b-A9C4-F95E7BED7428}.exe
{CAC117F6-9007-4455-A0F5-399D5C35FA80}.exe
{D25BDD00-B0CD-44bb-B100-E5FE7B4C8DE8}.exe
{DF67E7FA-CE53-4400-B8BD-1A68E99CB455}.exe
memory/920-18-0x0000000000AB0000-0x0000000000B71000-memory.dmp
memory/920-22-0x0000000000AB0000-0x0000000000B71000-memory.dmp
memory/1924-54-0x00000000009F0000-0x0000000000AB1000-memory.dmp
memory/1924-58-0x00000000009F0000-0x0000000000AB1000-memory.dmp
memory/2412-28-0x0000000000720000-0x00000000007E1000-memory.dmp
memory/2412-24-0x0000000000720000-0x00000000007E1000-memory.dmp
memory/2464-34-0x0000000000960000-0x0000000000A21000-memory.dmp
memory/2464-30-0x0000000000960000-0x0000000000A21000-memory.dmp
memory/2540-10-0x0000000000640000-0x0000000000701000-memory.dmp
memory/2540-6-0x0000000000640000-0x0000000000701000-memory.dmp
memory/2692-0-0x0000000000B30000-0x0000000000BF1000-memory.dmp
memory/2692-5-0x0000000000B30000-0x0000000000BF1000-memory.dmp
memory/2876-36-0x0000000000640000-0x0000000000701000-memory.dmp
memory/2876-40-0x0000000000640000-0x0000000000701000-memory.dmp
memory/3452-42-0x0000000000990000-0x0000000000A51000-memory.dmp
memory/3452-47-0x0000000000990000-0x0000000000A51000-memory.dmp
memory/3564-12-0x00000000009A0000-0x0000000000A61000-memory.dmp
memory/3564-16-0x00000000009A0000-0x0000000000A61000-memory.dmp
memory/4416-52-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/4416-48-0x0000000000830000-0x00000000008F1000-memory.dmp