Analysis
- max time kernel
149s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 14:22
General
- Target 2026-04-22_473896aa7856971efc33d9e2ae2b279e_elex_wannacry.exe
- Size 59KB
- Sample260422-rpy1macv7v
- SHA256 dd86ee15e7e2b44038dc048e2aa79532bebee685460d1c819ff2cdcb4afc76a4
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_473896aa7856971efc33d9e2ae2b279e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_473896aa7856971efc33d9e2ae2b279e_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3FBD0C88-BF5C-4e7c-B626-4C0D65781BD7}.exeC:\Windows\{3FBD0C88-BF5C-4e7c-B626-4C0D65781BD7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42BA7311-033D-4697-B4F3-D775736F5843}.exeC:\Windows\{42BA7311-033D-4697-B4F3-D775736F5843}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{236C3565-8FBC-4ca7-B388-A127B85A7B83}.exeC:\Windows\{236C3565-8FBC-4ca7-B388-A127B85A7B83}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63475850-367D-48fc-9336-7ECBB462969C}.exeC:\Windows\{63475850-367D-48fc-9336-7ECBB462969C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B1A4BFE6-4A6A-456d-A8C5-0D99EC353307}.exeC:\Windows\{B1A4BFE6-4A6A-456d-A8C5-0D99EC353307}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5800DEB-8B6A-4fab-8EB2-9EF6253DF2A0}.exeC:\Windows\{F5800DEB-8B6A-4fab-8EB2-9EF6253DF2A0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE069A3F-6907-4992-A6D3-BD7270AB9F95}.exeC:\Windows\{BE069A3F-6907-4992-A6D3-BD7270AB9F95}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0BE93541-FB45-48a7-9D3B-55837EB5F7B0}.exeC:\Windows\{0BE93541-FB45-48a7-9D3B-55837EB5F7B0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A46E3EF-4BE9-4c7c-8509-ECBCD333C4D5}.exeC:\Windows\{6A46E3EF-4BE9-4c7c-8509-ECBCD333C4D5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A20ECCD-6B30-4394-AB47-E8BEAFD1085E}.exeC:\Windows\{0A20ECCD-6B30-4394-AB47-E8BEAFD1085E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA760F87-E8E9-44ff-9B14-F1EFDDBAA20B}.exeC:\Windows\{FA760F87-E8E9-44ff-9B14-F1EFDDBAA20B}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A20E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A46E~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0BE93~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE069~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5800~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B1A4B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63475~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{236C3~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42BA7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3FBD0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0A20ECCD-6B30-4394-AB47-E8BEAFD1085E}.exe
{0BE93541-FB45-48a7-9D3B-55837EB5F7B0}.exe
{236C3565-8FBC-4ca7-B388-A127B85A7B83}.exe
{3FBD0C88-BF5C-4e7c-B626-4C0D65781BD7}.exe
{42BA7311-033D-4697-B4F3-D775736F5843}.exe
{63475850-367D-48fc-9336-7ECBB462969C}.exe
{6A46E3EF-4BE9-4c7c-8509-ECBCD333C4D5}.exe
{B1A4BFE6-4A6A-456d-A8C5-0D99EC353307}.exe
{BE069A3F-6907-4992-A6D3-BD7270AB9F95}.exe
{F5800DEB-8B6A-4fab-8EB2-9EF6253DF2A0}.exe
{FA760F87-E8E9-44ff-9B14-F1EFDDBAA20B}.exe
memory/1044-24-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/1044-27-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/3160-47-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/3160-42-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/3332-30-0x0000000000810000-0x00000000008CF000-memory.dmp
memory/3332-34-0x0000000000810000-0x00000000008CF000-memory.dmp
memory/4028-16-0x0000000000540000-0x00000000005FF000-memory.dmp
memory/4028-12-0x0000000000540000-0x00000000005FF000-memory.dmp
memory/4564-36-0x0000000000760000-0x000000000081F000-memory.dmp
memory/4564-39-0x0000000000760000-0x000000000081F000-memory.dmp
memory/4844-0-0x0000000000A00000-0x0000000000ABF000-memory.dmp
memory/4844-5-0x0000000000A00000-0x0000000000ABF000-memory.dmp
memory/4992-21-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/4992-18-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/5720-11-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5720-6-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5756-54-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/5756-58-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/5848-52-0x0000000000610000-0x00000000006CF000-memory.dmp
memory/5848-48-0x0000000000610000-0x00000000006CF000-memory.dmp
memory/6024-60-0x0000000000930000-0x00000000009EF000-memory.dmp
memory/6024-65-0x0000000000930000-0x00000000009EF000-memory.dmp