Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 13:17
General
- Target 2026-04-21_3fa4c85ef3cd49bb3d699b3748bc0877_elex_wannacry.exe
- Size 168KB
- Sample260421-qjn3ssax21
- SHA256 78ec5a055d25ac2c2244119a722bd6744b7df76beb61599f5445f7eba6e8cc04
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_3fa4c85ef3cd49bb3d699b3748bc0877_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_3fa4c85ef3cd49bb3d699b3748bc0877_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41D444AA-62CF-492a-A6DD-A341FC96D5A1}.exeC:\Windows\{41D444AA-62CF-492a-A6DD-A341FC96D5A1}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69C23E66-570E-4401-AE77-E50EDF946192}.exeC:\Windows\{69C23E66-570E-4401-AE77-E50EDF946192}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EBE78189-83B1-4ee4-B9C7-58E5D64C0BCE}.exeC:\Windows\{EBE78189-83B1-4ee4-B9C7-58E5D64C0BCE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{62A98DF7-8F92-4170-816F-7077BFEB2E33}.exeC:\Windows\{62A98DF7-8F92-4170-816F-7077BFEB2E33}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A58B5674-1246-4911-BD77-E2E1E0044271}.exeC:\Windows\{A58B5674-1246-4911-BD77-E2E1E0044271}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2CC17D5-3346-4fc0-8CC8-FA0D4EB88E00}.exeC:\Windows\{F2CC17D5-3346-4fc0-8CC8-FA0D4EB88E00}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD991EBE-CB3A-4052-88B4-3D68CFEC1D23}.exeC:\Windows\{FD991EBE-CB3A-4052-88B4-3D68CFEC1D23}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61D1D000-A179-4598-A4B1-BF674586845B}.exeC:\Windows\{61D1D000-A179-4598-A4B1-BF674586845B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C06FD38-16C9-4a67-A6B0-AB7DA0998DBD}.exeC:\Windows\{1C06FD38-16C9-4a67-A6B0-AB7DA0998DBD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BC38843-8545-485a-AC2E-111921502DB3}.exeC:\Windows\{4BC38843-8545-485a-AC2E-111921502DB3}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C06F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61D1D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD991~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2CC1~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A58B5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{62A98~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EBE78~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69C23~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41D44~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1C06FD38-16C9-4a67-A6B0-AB7DA0998DBD}.exe
{41D444AA-62CF-492a-A6DD-A341FC96D5A1}.exe
{4BC38843-8545-485a-AC2E-111921502DB3}.exe
{61D1D000-A179-4598-A4B1-BF674586845B}.exe
{62A98DF7-8F92-4170-816F-7077BFEB2E33}.exe
{69C23E66-570E-4401-AE77-E50EDF946192}.exe
{A58B5674-1246-4911-BD77-E2E1E0044271}.exe
{EBE78189-83B1-4ee4-B9C7-58E5D64C0BCE}.exe
{F2CC17D5-3346-4fc0-8CC8-FA0D4EB88E00}.exe
{FD991EBE-CB3A-4052-88B4-3D68CFEC1D23}.exe