Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 13:17
General
- Target 2026-04-21_3fa4c85ef3cd49bb3d699b3748bc0877_elex_wannacry.exe
- Size 168KB
- Sample260421-qjn3ssax21
- SHA256 78ec5a055d25ac2c2244119a722bd6744b7df76beb61599f5445f7eba6e8cc04
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_3fa4c85ef3cd49bb3d699b3748bc0877_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_3fa4c85ef3cd49bb3d699b3748bc0877_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E121329-E1F9-4874-8257-E62967F2602F}.exeC:\Windows\{4E121329-E1F9-4874-8257-E62967F2602F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AAE74279-1D3F-4bdb-B6BE-2670D10340C4}.exeC:\Windows\{AAE74279-1D3F-4bdb-B6BE-2670D10340C4}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1CDFF75D-8300-4337-84EC-DD81C14C1C52}.exeC:\Windows\{1CDFF75D-8300-4337-84EC-DD81C14C1C52}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0273EFEE-4B07-47b7-ADE9-C5DB4665EE39}.exeC:\Windows\{0273EFEE-4B07-47b7-ADE9-C5DB4665EE39}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2DAAD30-811B-49a5-A63C-42A118E36FF1}.exeC:\Windows\{F2DAAD30-811B-49a5-A63C-42A118E36FF1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AACD5F30-34AA-4d01-8F09-628ACDFC0478}.exeC:\Windows\{AACD5F30-34AA-4d01-8F09-628ACDFC0478}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F51E5D4B-DBAA-465b-BCEE-0B2DDED22E7C}.exeC:\Windows\{F51E5D4B-DBAA-465b-BCEE-0B2DDED22E7C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8EBA998D-22AD-4229-BD0E-A903E826FB13}.exeC:\Windows\{8EBA998D-22AD-4229-BD0E-A903E826FB13}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE8DC2A1-2D86-4bb2-A604-A2B29267098B}.exeC:\Windows\{DE8DC2A1-2D86-4bb2-A604-A2B29267098B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{783D82D2-5DBA-4cd6-9CD7-B180EB9B79F7}.exeC:\Windows\{783D82D2-5DBA-4cd6-9CD7-B180EB9B79F7}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{424AE195-1BD9-4555-A46C-B82367620153}.exeC:\Windows\{424AE195-1BD9-4555-A46C-B82367620153}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{783D8~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE8DC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EBA9~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F51E5~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AACD5~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2DAA~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0273E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1CDFF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AAE74~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E121~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0273EFEE-4B07-47b7-ADE9-C5DB4665EE39}.exe
{1CDFF75D-8300-4337-84EC-DD81C14C1C52}.exe
{424AE195-1BD9-4555-A46C-B82367620153}.exe
{4E121329-E1F9-4874-8257-E62967F2602F}.exe
{783D82D2-5DBA-4cd6-9CD7-B180EB9B79F7}.exe
{8EBA998D-22AD-4229-BD0E-A903E826FB13}.exe
{AACD5F30-34AA-4d01-8F09-628ACDFC0478}.exe
{AAE74279-1D3F-4bdb-B6BE-2670D10340C4}.exe
{DE8DC2A1-2D86-4bb2-A604-A2B29267098B}.exe
{F2DAAD30-811B-49a5-A63C-42A118E36FF1}.exe
{F51E5D4B-DBAA-465b-BCEE-0B2DDED22E7C}.exe