Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 03:47
General
- Target 2026-04-21_c30f2dd14a85f334dde6ec9e0e26d23d_elex_wannacry.exe
- Size 66KB
- Sample260421-ecb9wabs8v
- SHA256 d29557e8ab2a8eb50521c86911e75d3204f1e0fc7041a138a36907db185d8387
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 9 IoCs
- Detects Windows executables referencing non-Windows User-Agents 9 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_c30f2dd14a85f334dde6ec9e0e26d23d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_c30f2dd14a85f334dde6ec9e0e26d23d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21C1830E-66A4-4aed-8BC2-CF6A2BF04F3C}.exeC:\Windows\{21C1830E-66A4-4aed-8BC2-CF6A2BF04F3C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7E28854-E7CD-4f34-BC52-E81A0424C137}.exeC:\Windows\{A7E28854-E7CD-4f34-BC52-E81A0424C137}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16441301-A3AF-4b64-8F1C-6F0DD625FE84}.exeC:\Windows\{16441301-A3AF-4b64-8F1C-6F0DD625FE84}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8849A0A-6C6E-4d47-9595-CB957D70E484}.exeC:\Windows\{E8849A0A-6C6E-4d47-9595-CB957D70E484}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C00B11A-AC89-4fd1-A67A-4D8CFFB595A7}.exeC:\Windows\{6C00B11A-AC89-4fd1-A67A-4D8CFFB595A7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88379DCC-6A1F-4a67-9251-7AE968FBA1E4}.exeC:\Windows\{88379DCC-6A1F-4a67-9251-7AE968FBA1E4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7445043A-1EA7-45dc-B359-1FB86FEFC587}.exeC:\Windows\{7445043A-1EA7-45dc-B359-1FB86FEFC587}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB496F30-F15E-4b09-B598-AAFF1BE0B464}.exeC:\Windows\{BB496F30-F15E-4b09-B598-AAFF1BE0B464}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98611D20-4531-406f-AB43-F2C231279374}.exeC:\Windows\{98611D20-4531-406f-AB43-F2C231279374}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB496~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74450~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88379~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C00B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8849~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16441~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7E28~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21C18~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{16441301-A3AF-4b64-8F1C-6F0DD625FE84}.exe
{21C1830E-66A4-4aed-8BC2-CF6A2BF04F3C}.exe
{6C00B11A-AC89-4fd1-A67A-4D8CFFB595A7}.exe
{7445043A-1EA7-45dc-B359-1FB86FEFC587}.exe
{88379DCC-6A1F-4a67-9251-7AE968FBA1E4}.exe
{98611D20-4531-406f-AB43-F2C231279374}.exe
{A7E28854-E7CD-4f34-BC52-E81A0424C137}.exe
{BB496F30-F15E-4b09-B598-AAFF1BE0B464}.exe
{E8849A0A-6C6E-4d47-9595-CB957D70E484}.exe
memory/1608-14-0x0000000000630000-0x00000000006AC000-memory.dmp
memory/2084-20-0x0000000000970000-0x00000000009EC000-memory.dmp
memory/2876-26-0x0000000000830000-0x00000000008AC000-memory.dmp
memory/3224-38-0x0000000000890000-0x000000000090C000-memory.dmp
memory/3532-0-0x0000000000AA0000-0x0000000000B1C000-memory.dmp
memory/3532-2-0x0000000000AA0000-0x0000000000B1C000-memory.dmp
memory/3680-44-0x0000000000860000-0x00000000008DC000-memory.dmp
memory/4020-32-0x0000000000750000-0x00000000007CC000-memory.dmp
memory/4288-8-0x0000000000970000-0x00000000009EC000-memory.dmp
memory/4596-50-0x0000000000830000-0x00000000008AC000-memory.dmp