Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 08:28
General
- Target 2026-04-22_776e480189d76883e910e4951577ee53_elex_wannacry.exe
- Size 64KB
- Sample260422-kdedhsfv2t
- SHA256 3ab25efad2469d24b2125ce55f19d5b8869aa4cddf45515d67f28d75a3202ccf
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 30 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_776e480189d76883e910e4951577ee53_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_776e480189d76883e910e4951577ee53_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ACEC49B3-DAD3-4afa-A44D-6F476D8DC4CA}.exeC:\Windows\{ACEC49B3-DAD3-4afa-A44D-6F476D8DC4CA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69486551-02B5-464c-A310-4AEB6161D722}.exeC:\Windows\{69486551-02B5-464c-A310-4AEB6161D722}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D0BD74F-3A19-4b92-91DD-0E89CEDA77F5}.exeC:\Windows\{9D0BD74F-3A19-4b92-91DD-0E89CEDA77F5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C04B9676-49DC-4cc6-90DD-44257CB64A87}.exeC:\Windows\{C04B9676-49DC-4cc6-90DD-44257CB64A87}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC757185-E2B7-445c-B66A-DAB1C5143C33}.exeC:\Windows\{FC757185-E2B7-445c-B66A-DAB1C5143C33}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD182ACC-F65D-49ad-ABE8-A442B27C8F07}.exeC:\Windows\{BD182ACC-F65D-49ad-ABE8-A442B27C8F07}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09549BA1-3AF9-48a8-B676-8ADC0E64042C}.exeC:\Windows\{09549BA1-3AF9-48a8-B676-8ADC0E64042C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F26DE681-B72B-4e4e-8731-76DF08C57B94}.exeC:\Windows\{F26DE681-B72B-4e4e-8731-76DF08C57B94}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FDCBC2D3-2880-4dee-A7AB-19F99716B075}.exeC:\Windows\{FDCBC2D3-2880-4dee-A7AB-19F99716B075}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8BBDE72E-3343-4580-A989-4290CFBF1E85}.exeC:\Windows\{8BBDE72E-3343-4580-A989-4290CFBF1E85}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FDCBC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F26DE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09549~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD182~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC757~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C04B9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D0BD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69486~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ACEC4~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{09549BA1-3AF9-48a8-B676-8ADC0E64042C}.exe
{69486551-02B5-464c-A310-4AEB6161D722}.exe
{8BBDE72E-3343-4580-A989-4290CFBF1E85}.exe
{9D0BD74F-3A19-4b92-91DD-0E89CEDA77F5}.exe
{ACEC49B3-DAD3-4afa-A44D-6F476D8DC4CA}.exe
{BD182ACC-F65D-49ad-ABE8-A442B27C8F07}.exe
{C04B9676-49DC-4cc6-90DD-44257CB64A87}.exe
{F26DE681-B72B-4e4e-8731-76DF08C57B94}.exe
{FC757185-E2B7-445c-B66A-DAB1C5143C33}.exe
{FDCBC2D3-2880-4dee-A7AB-19F99716B075}.exe
memory/2096-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2096-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2096-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2148-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2148-57-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2432-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2432-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3424-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3424-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3524-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3760-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3760-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4264-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4568-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4568-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4972-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5044-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5044-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5044-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5108-58-0x0000000000400000-0x0000000000410000-memory.dmp