Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
21/04/2026, 15:22
General
- Target 2026-04-21_f9b9bbc53f9e6cd998430ed80add73f9_elex_wannacry.exe
- Size 116KB
- Sample260421-srvxesgz2k
- SHA256 ae29a1d495bbc5e02e2b690030a00aed4162975412ec4b56e261ce2c0af84efb
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-21_f9b9bbc53f9e6cd998430ed80add73f9_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-21_f9b9bbc53f9e6cd998430ed80add73f9_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B87E02F8-9C55-4e3e-8ECD-AC50E5475F89}.exeC:\Windows\{B87E02F8-9C55-4e3e-8ECD-AC50E5475F89}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{66623F5B-22F5-453e-A2E9-AFA7A1168AD1}.exeC:\Windows\{66623F5B-22F5-453e-A2E9-AFA7A1168AD1}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3DFD0340-8F75-4b8e-A1B1-0CE07E96FC71}.exeC:\Windows\{3DFD0340-8F75-4b8e-A1B1-0CE07E96FC71}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC900AF9-1599-4b10-B2A6-BEDCB248C62F}.exeC:\Windows\{EC900AF9-1599-4b10-B2A6-BEDCB248C62F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{630932D6-62AD-42b8-BB15-F2FCAE238C97}.exeC:\Windows\{630932D6-62AD-42b8-BB15-F2FCAE238C97}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5206A0BD-1116-4917-9D7E-36EAB4AB9369}.exeC:\Windows\{5206A0BD-1116-4917-9D7E-36EAB4AB9369}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{925D1769-1948-4bed-9E14-313AEA9DCD31}.exeC:\Windows\{925D1769-1948-4bed-9E14-313AEA9DCD31}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6602B632-E4BA-4858-A69E-142212936FAB}.exeC:\Windows\{6602B632-E4BA-4858-A69E-142212936FAB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFD7441D-61E5-4858-B92E-313FBF0F2E20}.exeC:\Windows\{CFD7441D-61E5-4858-B92E-313FBF0F2E20}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{622CE2DF-FEB0-4e16-ABA8-F74656BDFF51}.exeC:\Windows\{622CE2DF-FEB0-4e16-ABA8-F74656BDFF51}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5F3E3CEB-76CD-4ad6-8577-D7CEF98090E1}.exeC:\Windows\{5F3E3CEB-76CD-4ad6-8577-D7CEF98090E1}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{622CE~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFD74~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6602B~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{925D1~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5206A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63093~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC900~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3DFD0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{66623~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B87E0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3DFD0340-8F75-4b8e-A1B1-0CE07E96FC71}.exe
{5206A0BD-1116-4917-9D7E-36EAB4AB9369}.exe
{5F3E3CEB-76CD-4ad6-8577-D7CEF98090E1}.exe
{622CE2DF-FEB0-4e16-ABA8-F74656BDFF51}.exe
{630932D6-62AD-42b8-BB15-F2FCAE238C97}.exe
{6602B632-E4BA-4858-A69E-142212936FAB}.exe
{66623F5B-22F5-453e-A2E9-AFA7A1168AD1}.exe
{925D1769-1948-4bed-9E14-313AEA9DCD31}.exe
{B87E02F8-9C55-4e3e-8ECD-AC50E5475F89}.exe
{CFD7441D-61E5-4858-B92E-313FBF0F2E20}.exe
{EC900AF9-1599-4b10-B2A6-BEDCB248C62F}.exe
memory/1384-48-0x0000000003DA0000-0x0000000003E03000-memory.dmp
memory/1384-51-0x0000000003DA0000-0x0000000003E03000-memory.dmp
memory/1780-47-0x0000000002120000-0x0000000002183000-memory.dmp
memory/1780-42-0x0000000002120000-0x0000000002183000-memory.dmp
memory/1848-40-0x0000000003C80000-0x0000000003CE3000-memory.dmp
memory/1848-36-0x0000000003C80000-0x0000000003CE3000-memory.dmp
memory/2192-17-0x0000000003C90000-0x0000000003CF3000-memory.dmp
memory/2192-12-0x0000000003C90000-0x0000000003CF3000-memory.dmp
memory/2464-33-0x0000000003CC0000-0x0000000003D23000-memory.dmp
memory/2464-30-0x0000000003CC0000-0x0000000003D23000-memory.dmp
memory/2736-54-0x0000000002100000-0x0000000002163000-memory.dmp
memory/2736-58-0x0000000002100000-0x0000000002163000-memory.dmp
memory/2744-10-0x0000000003CC0000-0x0000000003D23000-memory.dmp
memory/2744-6-0x0000000003CC0000-0x0000000003D23000-memory.dmp
memory/3312-60-0x0000000003B70000-0x0000000003BD3000-memory.dmp
memory/3312-64-0x0000000003B70000-0x0000000003BD3000-memory.dmp
memory/3812-29-0x0000000002110000-0x0000000002173000-memory.dmp
memory/3812-24-0x0000000002110000-0x0000000002173000-memory.dmp
memory/4776-21-0x0000000002180000-0x00000000021E3000-memory.dmp
memory/4776-18-0x0000000002180000-0x00000000021E3000-memory.dmp
memory/4912-0-0x0000000003E40000-0x0000000003EA3000-memory.dmp
memory/4912-5-0x0000000003E40000-0x0000000003EA3000-memory.dmp