Analysis
- max time kernel
149s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 03:47
General
- Target 2026-04-21_bcecc9e719423e2fa6383711f0ece104_elex_wannacry.exe
- Size 59KB
- Sample260421-eb878abs8s
- SHA256 ce5aaca21e8a606d6860e239111f3135edb7367097e00797d946e15ac1531c52
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_bcecc9e719423e2fa6383711f0ece104_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_bcecc9e719423e2fa6383711f0ece104_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED00F2EC-41A4-4c52-A2B0-34FE066BD3EC}.exeC:\Windows\{ED00F2EC-41A4-4c52-A2B0-34FE066BD3EC}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D83C011-BEBA-4e59-98FA-2C7260812371}.exeC:\Windows\{0D83C011-BEBA-4e59-98FA-2C7260812371}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB48EBFF-8899-4add-8145-D0FBA58F95B2}.exeC:\Windows\{DB48EBFF-8899-4add-8145-D0FBA58F95B2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98C8EE0D-1826-4d4c-9656-C20BD8BCAC53}.exeC:\Windows\{98C8EE0D-1826-4d4c-9656-C20BD8BCAC53}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7923AED1-50B1-4979-909A-B3CCB1B4FBB3}.exeC:\Windows\{7923AED1-50B1-4979-909A-B3CCB1B4FBB3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6272CA92-16E5-43cb-BB4E-95E3CFFC3F71}.exeC:\Windows\{6272CA92-16E5-43cb-BB4E-95E3CFFC3F71}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3A53A4A-6250-4e33-BEF3-D2BF941D6B59}.exeC:\Windows\{D3A53A4A-6250-4e33-BEF3-D2BF941D6B59}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C455EA9F-75EA-4630-991E-A089553FC67E}.exeC:\Windows\{C455EA9F-75EA-4630-991E-A089553FC67E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{560FD8AA-730E-4050-835F-ADDE1F0EC72E}.exeC:\Windows\{560FD8AA-730E-4050-835F-ADDE1F0EC72E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6AE925EB-79DC-4624-B437-43BFA784B6BB}.exeC:\Windows\{6AE925EB-79DC-4624-B437-43BFA784B6BB}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4F4819D-8430-4851-B08D-6C2BCB595FBB}.exeC:\Windows\{F4F4819D-8430-4851-B08D-6C2BCB595FBB}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6AE92~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{560FD~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C455E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3A53~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6272C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7923A~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98C8E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB48E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D83C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED00F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0D83C011-BEBA-4e59-98FA-2C7260812371}.exe
{560FD8AA-730E-4050-835F-ADDE1F0EC72E}.exe
{6272CA92-16E5-43cb-BB4E-95E3CFFC3F71}.exe
{6AE925EB-79DC-4624-B437-43BFA784B6BB}.exe
{7923AED1-50B1-4979-909A-B3CCB1B4FBB3}.exe
{98C8EE0D-1826-4d4c-9656-C20BD8BCAC53}.exe
{C455EA9F-75EA-4630-991E-A089553FC67E}.exe
{D3A53A4A-6250-4e33-BEF3-D2BF941D6B59}.exe
{DB48EBFF-8899-4add-8145-D0FBA58F95B2}.exe
{ED00F2EC-41A4-4c52-A2B0-34FE066BD3EC}.exe
{F4F4819D-8430-4851-B08D-6C2BCB595FBB}.exe
memory/1280-18-0x0000000000850000-0x00000000008E6000-memory.dmp
memory/1280-22-0x0000000000850000-0x00000000008E6000-memory.dmp
memory/1284-16-0x0000000000790000-0x0000000000826000-memory.dmp
memory/1284-12-0x0000000000790000-0x0000000000826000-memory.dmp
memory/1588-48-0x00000000007E0000-0x0000000000876000-memory.dmp
memory/1588-52-0x00000000007E0000-0x0000000000876000-memory.dmp
memory/1692-24-0x0000000000880000-0x0000000000916000-memory.dmp
memory/1692-28-0x0000000000880000-0x0000000000916000-memory.dmp
memory/3604-30-0x0000000000550000-0x00000000005E6000-memory.dmp
memory/3604-33-0x0000000000550000-0x00000000005E6000-memory.dmp
memory/3884-0-0x00000000008B0000-0x0000000000946000-memory.dmp
memory/3884-5-0x00000000008B0000-0x0000000000946000-memory.dmp
memory/4220-39-0x0000000000990000-0x0000000000A26000-memory.dmp
memory/4220-36-0x0000000000990000-0x0000000000A26000-memory.dmp
memory/4688-60-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/4688-64-0x00000000007D0000-0x0000000000866000-memory.dmp
memory/4816-11-0x0000000000790000-0x0000000000826000-memory.dmp
memory/4816-6-0x0000000000790000-0x0000000000826000-memory.dmp
memory/5752-54-0x00000000008C0000-0x0000000000956000-memory.dmp
memory/5752-57-0x00000000008C0000-0x0000000000956000-memory.dmp
memory/5884-42-0x0000000000740000-0x00000000007D6000-memory.dmp
memory/5884-46-0x0000000000740000-0x00000000007D6000-memory.dmp