Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 14:22
General
- Target 2026-04-22_473896aa7856971efc33d9e2ae2b279e_elex_wannacry.exe
- Size 59KB
- Sample260422-rpy1macv7v
- SHA256 dd86ee15e7e2b44038dc048e2aa79532bebee685460d1c819ff2cdcb4afc76a4
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_473896aa7856971efc33d9e2ae2b279e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_473896aa7856971efc33d9e2ae2b279e_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED2FC162-B101-44d3-A3D3-47A95A6F4D84}.exeC:\Windows\{ED2FC162-B101-44d3-A3D3-47A95A6F4D84}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB4E4FE6-348F-4109-9E7D-AF8A862E9A64}.exeC:\Windows\{CB4E4FE6-348F-4109-9E7D-AF8A862E9A64}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E41889F9-21E1-4620-8962-ACB0BBE8B97A}.exeC:\Windows\{E41889F9-21E1-4620-8962-ACB0BBE8B97A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7BB8F58-CA9E-426d-BF2A-8F732B084B1B}.exeC:\Windows\{A7BB8F58-CA9E-426d-BF2A-8F732B084B1B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5B70B6C-736B-452d-9C3B-E72A0CE0E9B6}.exeC:\Windows\{A5B70B6C-736B-452d-9C3B-E72A0CE0E9B6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8B290F5-4DF3-4c18-9F0A-39FD49CE3147}.exeC:\Windows\{B8B290F5-4DF3-4c18-9F0A-39FD49CE3147}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A78D0572-640F-450f-B804-C7374F9ACB29}.exeC:\Windows\{A78D0572-640F-450f-B804-C7374F9ACB29}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41909D05-91EA-4d87-AE84-80E05D3CE310}.exeC:\Windows\{41909D05-91EA-4d87-AE84-80E05D3CE310}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04BE5138-E835-49cd-BFCC-73E2DE095F9D}.exeC:\Windows\{04BE5138-E835-49cd-BFCC-73E2DE095F9D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0AE7D702-F5CC-4fe3-8574-3FBDA2D7E9AA}.exeC:\Windows\{0AE7D702-F5CC-4fe3-8574-3FBDA2D7E9AA}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04BE5~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41909~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A78D0~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8B29~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5B70~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7BB8~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E4188~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB4E4~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED2FC~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{04BE5138-E835-49cd-BFCC-73E2DE095F9D}.exe
{0AE7D702-F5CC-4fe3-8574-3FBDA2D7E9AA}.exe
{41909D05-91EA-4d87-AE84-80E05D3CE310}.exe
{A5B70B6C-736B-452d-9C3B-E72A0CE0E9B6}.exe
{A78D0572-640F-450f-B804-C7374F9ACB29}.exe
{A7BB8F58-CA9E-426d-BF2A-8F732B084B1B}.exe
{B8B290F5-4DF3-4c18-9F0A-39FD49CE3147}.exe
{CB4E4FE6-348F-4109-9E7D-AF8A862E9A64}.exe
{E41889F9-21E1-4620-8962-ACB0BBE8B97A}.exe
{ED2FC162-B101-44d3-A3D3-47A95A6F4D84}.exe
memory/2976-54-0x0000000000820000-0x00000000008E1000-memory.dmp
memory/2976-58-0x0000000000820000-0x00000000008E1000-memory.dmp
memory/3832-52-0x0000000000850000-0x0000000000911000-memory.dmp
memory/3832-48-0x0000000000850000-0x0000000000911000-memory.dmp
memory/4188-36-0x00000000009A0000-0x0000000000A61000-memory.dmp
memory/4188-40-0x00000000009A0000-0x0000000000A61000-memory.dmp
memory/4536-10-0x0000000000960000-0x0000000000A21000-memory.dmp
memory/4536-6-0x0000000000960000-0x0000000000A21000-memory.dmp
memory/4604-22-0x00000000008D0000-0x0000000000991000-memory.dmp
memory/4604-18-0x00000000008D0000-0x0000000000991000-memory.dmp
memory/4916-16-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/4916-12-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/4956-0-0x0000000000AD0000-0x0000000000B91000-memory.dmp
memory/4956-5-0x0000000000AD0000-0x0000000000B91000-memory.dmp
memory/5044-42-0x0000000000890000-0x0000000000951000-memory.dmp
memory/5044-46-0x0000000000890000-0x0000000000951000-memory.dmp
memory/5228-34-0x0000000000980000-0x0000000000A41000-memory.dmp
memory/5228-30-0x0000000000980000-0x0000000000A41000-memory.dmp
memory/6140-27-0x0000000000840000-0x0000000000901000-memory.dmp
memory/6140-24-0x0000000000840000-0x0000000000901000-memory.dmp