Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
21/04/2026, 14:30
General
- Target 2026-04-21_af2fdeb4fcdb32b878d3c4a9db9be697_elex_wannacry.exe
- Size 60KB
- Sample260421-rvmvjsgt3m
- SHA256 f77e7c9140c8119c17a1598c1b139c2af13871741ef1e9a6cfdc0c7b83518675
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 8 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 8 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 16 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 8 IoCs
- Drops file in Windows directory 8 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_af2fdeb4fcdb32b878d3c4a9db9be697_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_af2fdeb4fcdb32b878d3c4a9db9be697_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5222987A-D34B-4ece-84E8-CDDD11FFA069}.exeC:\Windows\{5222987A-D34B-4ece-84E8-CDDD11FFA069}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4AA5939-96DD-4bce-903B-4689F77F05BB}.exeC:\Windows\{C4AA5939-96DD-4bce-903B-4689F77F05BB}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{388E66E3-8351-4c72-BD5E-F2901FE727E2}.exeC:\Windows\{388E66E3-8351-4c72-BD5E-F2901FE727E2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE221374-741C-4b2a-A551-50304AB8255B}.exeC:\Windows\{AE221374-741C-4b2a-A551-50304AB8255B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{038E51EB-33ED-486a-98AC-705993AECA96}.exeC:\Windows\{038E51EB-33ED-486a-98AC-705993AECA96}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DECCB64-8F03-4b78-9867-1BA2030507F2}.exeC:\Windows\{1DECCB64-8F03-4b78-9867-1BA2030507F2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99809DD5-A2CA-4a70-AD12-86BDC2EA7C44}.exeC:\Windows\{99809DD5-A2CA-4a70-AD12-86BDC2EA7C44}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB8DF830-4284-4f98-88A4-303DC7006654}.exeC:\Windows\{FB8DF830-4284-4f98-88A4-303DC7006654}.exe9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99809~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DECC~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{038E5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE221~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{388E6~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4AA5~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52229~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{038E51EB-33ED-486a-98AC-705993AECA96}.exe
{1DECCB64-8F03-4b78-9867-1BA2030507F2}.exe
{388E66E3-8351-4c72-BD5E-F2901FE727E2}.exe
{5222987A-D34B-4ece-84E8-CDDD11FFA069}.exe
{99809DD5-A2CA-4a70-AD12-86BDC2EA7C44}.exe
{AE221374-741C-4b2a-A551-50304AB8255B}.exe
{C4AA5939-96DD-4bce-903B-4689F77F05BB}.exe
{FB8DF830-4284-4f98-88A4-303DC7006654}.exe
memory/1432-40-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/1432-36-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/1876-24-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/1876-28-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/2088-33-0x0000000000AB0000-0x0000000000B6F000-memory.dmp
memory/2088-30-0x0000000000AB0000-0x0000000000B6F000-memory.dmp
memory/3128-15-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/3128-12-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/3552-10-0x0000000000A10000-0x0000000000ACF000-memory.dmp
memory/3552-6-0x0000000000A10000-0x0000000000ACF000-memory.dmp
memory/3684-0-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
memory/3684-5-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
memory/3856-48-0x0000000000980000-0x0000000000A3F000-memory.dmp
memory/4228-18-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/4228-22-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/5020-42-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/5020-46-0x0000000000830000-0x00000000008EF000-memory.dmp