Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 16:08
General
- Target 2026-04-22_a8e7954ef48a709e6619dae503948df1_elex_wannacry.exe
- Size 64KB
- Sample260422-tk67jsaz7r
- SHA256 8ec4d3685f718931b09c2bd9447f8e6b9d19503ab596ada012a826e5bd693515
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 30 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_a8e7954ef48a709e6619dae503948df1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_a8e7954ef48a709e6619dae503948df1_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E88A8539-FBF7-45a6-8FE6-8448A4DCBEC5}.exeC:\Windows\{E88A8539-FBF7-45a6-8FE6-8448A4DCBEC5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E6A1000-D494-40ca-9A74-88D3B79B4F38}.exeC:\Windows\{4E6A1000-D494-40ca-9A74-88D3B79B4F38}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2EB8918-4420-466f-BACD-77A2DA1BA1C4}.exeC:\Windows\{B2EB8918-4420-466f-BACD-77A2DA1BA1C4}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFFEB5AC-0308-49df-A261-13B333B88109}.exeC:\Windows\{BFFEB5AC-0308-49df-A261-13B333B88109}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C24F733-A65C-4a6e-8EB9-F137523E5FB6}.exeC:\Windows\{8C24F733-A65C-4a6e-8EB9-F137523E5FB6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D51FA39F-EDB3-4e2d-ADF1-06BC8EE494A0}.exeC:\Windows\{D51FA39F-EDB3-4e2d-ADF1-06BC8EE494A0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB91E7E8-AC8A-4107-882B-11C9A13B8164}.exeC:\Windows\{AB91E7E8-AC8A-4107-882B-11C9A13B8164}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3632F179-6471-4a16-A64C-DE4534572B83}.exeC:\Windows\{3632F179-6471-4a16-A64C-DE4534572B83}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D98B476E-DB15-4a36-AE32-1FBFE69E555E}.exeC:\Windows\{D98B476E-DB15-4a36-AE32-1FBFE69E555E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{288809A1-BBEF-455d-A14D-C8FC28719554}.exeC:\Windows\{288809A1-BBEF-455d-A14D-C8FC28719554}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97158887-FDEF-4324-96D5-D829F622CD1B}.exeC:\Windows\{97158887-FDEF-4324-96D5-D829F622CD1B}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28880~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D98B4~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3632F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB91E~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D51FA~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C24F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFFEB~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2EB8~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4E6A1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E88A8~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{288809A1-BBEF-455d-A14D-C8FC28719554}.exe
{3632F179-6471-4a16-A64C-DE4534572B83}.exe
{4E6A1000-D494-40ca-9A74-88D3B79B4F38}.exe
{8C24F733-A65C-4a6e-8EB9-F137523E5FB6}.exe
{97158887-FDEF-4324-96D5-D829F622CD1B}.exe
{AB91E7E8-AC8A-4107-882B-11C9A13B8164}.exe
{B2EB8918-4420-466f-BACD-77A2DA1BA1C4}.exe
{BFFEB5AC-0308-49df-A261-13B333B88109}.exe
{D51FA39F-EDB3-4e2d-ADF1-06BC8EE494A0}.exe
{D98B476E-DB15-4a36-AE32-1FBFE69E555E}.exe
{E88A8539-FBF7-45a6-8FE6-8448A4DCBEC5}.exe
memory/1444-76-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1444-71-0x0000000002010000-0x0000000002073000-memory.dmp
memory/1444-75-0x0000000002010000-0x0000000002073000-memory.dmp
memory/1752-13-0x0000000003B70000-0x0000000003BD3000-memory.dmp
memory/1752-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1752-9-0x0000000003B70000-0x0000000003BD3000-memory.dmp
memory/2292-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2292-56-0x0000000001FF0000-0x0000000002053000-memory.dmp
memory/2292-61-0x0000000001FF0000-0x0000000002053000-memory.dmp
memory/2376-46-0x0000000003CF0000-0x0000000003D53000-memory.dmp
memory/2376-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2376-41-0x0000000003CF0000-0x0000000003D53000-memory.dmp
memory/2568-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2568-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2568-33-0x0000000003CA0000-0x0000000003D03000-memory.dmp
memory/2568-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2568-38-0x0000000003CA0000-0x0000000003D03000-memory.dmp
memory/3424-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3424-64-0x0000000002230000-0x0000000002293000-memory.dmp
memory/3424-68-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3424-67-0x0000000002230000-0x0000000002293000-memory.dmp
memory/4176-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4176-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4176-30-0x0000000003C70000-0x0000000003CD3000-memory.dmp
memory/4176-25-0x0000000003C70000-0x0000000003CD3000-memory.dmp
memory/4252-1-0x0000000002190000-0x00000000021F3000-memory.dmp
memory/4252-7-0x0000000002190000-0x00000000021F3000-memory.dmp
memory/4252-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4252-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4252-2-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4344-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4344-49-0x0000000003CB0000-0x0000000003D13000-memory.dmp
memory/4344-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4344-54-0x0000000003CB0000-0x0000000003D13000-memory.dmp
memory/4372-83-0x0000000001FF0000-0x0000000002053000-memory.dmp
memory/4372-78-0x0000000001FF0000-0x0000000002053000-memory.dmp
memory/4372-84-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4508-20-0x0000000003CE0000-0x0000000003D43000-memory.dmp
memory/4508-15-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4508-17-0x0000000003CE0000-0x0000000003D43000-memory.dmp
memory/4508-21-0x0000000000400000-0x0000000000410000-memory.dmp