Analysis
- max time kernel
149s - max time network
152s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
23/04/2026, 14:01
General
- Target 2026-04-23_5917efcb1c63a43398ab61e72e5818d6_elex_wannacry.exe
- Size 60KB
- Sample260423-rblhdaet5q
- SHA256 3c314ce553405199607d5105d861a694eecbe94c65f0d0cb98c7f20165b787f6
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Detects Windows executables referencing non-Windows User-Agents 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-23_5917efcb1c63a43398ab61e72e5818d6_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-23_5917efcb1c63a43398ab61e72e5818d6_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{947C00B2-DE06-4874-BEAB-29AECD5677B6}.exeC:\Windows\{947C00B2-DE06-4874-BEAB-29AECD5677B6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CAB7A40-324A-42cb-A388-D5E62628E2B8}.exeC:\Windows\{8CAB7A40-324A-42cb-A388-D5E62628E2B8}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94C90DBD-9576-4634-8175-DAC37DEC6059}.exeC:\Windows\{94C90DBD-9576-4634-8175-DAC37DEC6059}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36147C19-7C47-4f24-91D1-93DA3BBBC6D6}.exeC:\Windows\{36147C19-7C47-4f24-91D1-93DA3BBBC6D6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FA04449-565E-4226-921C-33C3085CDFC2}.exeC:\Windows\{8FA04449-565E-4226-921C-33C3085CDFC2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{390B77C9-BF8F-4815-AF06-BB879A75368D}.exeC:\Windows\{390B77C9-BF8F-4815-AF06-BB879A75368D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32C9E739-6013-48ed-9D33-C207FB16A78F}.exeC:\Windows\{32C9E739-6013-48ed-9D33-C207FB16A78F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5516ABB-7AA9-4815-ABFC-5995BBD758F3}.exeC:\Windows\{E5516ABB-7AA9-4815-ABFC-5995BBD758F3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{271E1D1C-DDA0-4822-ADD7-7AB2ED46223A}.exeC:\Windows\{271E1D1C-DDA0-4822-ADD7-7AB2ED46223A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38FCF761-9A35-435c-ACF2-D7640283A9F4}.exeC:\Windows\{38FCF761-9A35-435c-ACF2-D7640283A9F4}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{271E1~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5516~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32C9E~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{390B7~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FA04~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36147~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94C90~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CAB7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{947C0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{271E1D1C-DDA0-4822-ADD7-7AB2ED46223A}.exe
{32C9E739-6013-48ed-9D33-C207FB16A78F}.exe
{36147C19-7C47-4f24-91D1-93DA3BBBC6D6}.exe
{38FCF761-9A35-435c-ACF2-D7640283A9F4}.exe
{390B77C9-BF8F-4815-AF06-BB879A75368D}.exe
{8CAB7A40-324A-42cb-A388-D5E62628E2B8}.exe
{8FA04449-565E-4226-921C-33C3085CDFC2}.exe
{947C00B2-DE06-4874-BEAB-29AECD5677B6}.exe
{94C90DBD-9576-4634-8175-DAC37DEC6059}.exe
{E5516ABB-7AA9-4815-ABFC-5995BBD758F3}.exe