Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 16:08
General
- Target 2026-04-22_a8e7954ef48a709e6619dae503948df1_elex_wannacry.exe
- Size 64KB
- Sample260422-tk67jsaz7r
- SHA256 8ec4d3685f718931b09c2bd9447f8e6b9d19503ab596ada012a826e5bd693515
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 27 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-22_a8e7954ef48a709e6619dae503948df1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-22_a8e7954ef48a709e6619dae503948df1_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FAFBC603-50E7-4ca6-9EB2-FBCC9DABCAD1}.exeC:\Windows\{FAFBC603-50E7-4ca6-9EB2-FBCC9DABCAD1}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C74555D3-F2AF-43ae-A551-31A4EE708DD3}.exeC:\Windows\{C74555D3-F2AF-43ae-A551-31A4EE708DD3}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exeC:\Windows\{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42605C30-5051-4edf-88E6-0C3B00CFD214}.exeC:\Windows\{42605C30-5051-4edf-88E6-0C3B00CFD214}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B080994-C15F-4eca-8A4B-A8497599F91E}.exeC:\Windows\{2B080994-C15F-4eca-8A4B-A8497599F91E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E716E48-F2DA-45b3-8306-7951AA58A5DA}.exeC:\Windows\{1E716E48-F2DA-45b3-8306-7951AA58A5DA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC6A8BD9-65BA-49da-85CA-178A66FCAB76}.exeC:\Windows\{CC6A8BD9-65BA-49da-85CA-178A66FCAB76}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3212DD46-0B2D-4fc2-B749-4153EB319818}.exeC:\Windows\{3212DD46-0B2D-4fc2-B749-4153EB319818}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D241E08A-F26C-43f4-BFEB-AE5B753227A2}.exeC:\Windows\{D241E08A-F26C-43f4-BFEB-AE5B753227A2}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3212D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC6A8~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E716~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B080~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42605~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E57F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C7455~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAFBC~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0E57F35B-37DF-4b14-B245-ED7D419ED8CF}.exe
{1E716E48-F2DA-45b3-8306-7951AA58A5DA}.exe
{2B080994-C15F-4eca-8A4B-A8497599F91E}.exe
{3212DD46-0B2D-4fc2-B749-4153EB319818}.exe
{42605C30-5051-4edf-88E6-0C3B00CFD214}.exe
{C74555D3-F2AF-43ae-A551-31A4EE708DD3}.exe
{CC6A8BD9-65BA-49da-85CA-178A66FCAB76}.exe
{D241E08A-F26C-43f4-BFEB-AE5B753227A2}.exe
{FAFBC603-50E7-4ca6-9EB2-FBCC9DABCAD1}.exe
memory/396-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/396-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/396-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/644-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/644-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/644-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/752-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1420-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1420-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1728-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1728-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2380-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2380-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2444-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3028-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3028-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3796-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3796-19-0x0000000000400000-0x0000000000410000-memory.dmp