Analysis
- max time kernel
149s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 14:56
General
- Target 2026-04-22_6e27d51ccfcd7c99c5d0c6aece779039_elex_wannacry.exe
- Size 64KB
- Sample260422-sa296sds8x
- SHA256 7eacfc292298754d07998e43c166577597f9e306713ce1d02c91ceceed6ab253
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 28 IoCs
- Detects Windows executables referencing non-Windows User-Agents 28 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_6e27d51ccfcd7c99c5d0c6aece779039_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_6e27d51ccfcd7c99c5d0c6aece779039_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D4F018B-24A4-42eb-8F35-F57D8BB6B6BB}.exeC:\Windows\{5D4F018B-24A4-42eb-8F35-F57D8BB6B6BB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41DB1FD7-DC5D-42b0-A813-81C55EC6CB43}.exeC:\Windows\{41DB1FD7-DC5D-42b0-A813-81C55EC6CB43}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D499188-1153-459a-B7BE-2BB06F7B8B85}.exeC:\Windows\{6D499188-1153-459a-B7BE-2BB06F7B8B85}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15475D58-5E65-4a5f-93B7-21A71D6BA522}.exeC:\Windows\{15475D58-5E65-4a5f-93B7-21A71D6BA522}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C034E905-6661-4a23-AAB9-8E02F98A6F27}.exeC:\Windows\{C034E905-6661-4a23-AAB9-8E02F98A6F27}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C0DA18F8-F94F-4dc0-84C3-BFCF80BC0ABD}.exeC:\Windows\{C0DA18F8-F94F-4dc0-84C3-BFCF80BC0ABD}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{22D2BDDC-7691-4c54-9AFE-4915AEBFE855}.exeC:\Windows\{22D2BDDC-7691-4c54-9AFE-4915AEBFE855}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A4FE136-EA10-44ca-B276-BDC1363D3174}.exeC:\Windows\{7A4FE136-EA10-44ca-B276-BDC1363D3174}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5BBCDE5D-2D23-4efe-853D-024E01C56649}.exeC:\Windows\{5BBCDE5D-2D23-4efe-853D-024E01C56649}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A4FE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22D2B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C0DA1~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C034E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15475~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D499~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41DB1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D4F0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{15475D58-5E65-4a5f-93B7-21A71D6BA522}.exe
{22D2BDDC-7691-4c54-9AFE-4915AEBFE855}.exe
{41DB1FD7-DC5D-42b0-A813-81C55EC6CB43}.exe
{5BBCDE5D-2D23-4efe-853D-024E01C56649}.exe
{5D4F018B-24A4-42eb-8F35-F57D8BB6B6BB}.exe
{6D499188-1153-459a-B7BE-2BB06F7B8B85}.exe
{7A4FE136-EA10-44ca-B276-BDC1363D3174}.exe
{C034E905-6661-4a23-AAB9-8E02F98A6F27}.exe
{C0DA18F8-F94F-4dc0-84C3-BFCF80BC0ABD}.exe
memory/1252-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1252-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3560-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3796-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3796-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3892-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3996-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4672-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4672-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4672-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4932-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4932-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4932-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5296-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5296-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5380-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5380-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5392-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5392-13-0x0000000000400000-0x0000000000410000-memory.dmp