Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 04:11
General
- Target 2026-04-24_82fa0a3e88153e3b8b9674bd4c639750_elex_wannacry.exe
- Size 372KB
- Sample260424-er7dkaev8s
- SHA256 a5e38071ed05076013b99e9f666b05261b6b6887d737ae2537999067be40084e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_82fa0a3e88153e3b8b9674bd4c639750_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_82fa0a3e88153e3b8b9674bd4c639750_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67DC38A6-1AC7-4322-A738-D972E0812888}.exeC:\Windows\{67DC38A6-1AC7-4322-A738-D972E0812888}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{112176C2-AB93-4e65-A057-BFF314F665BE}.exeC:\Windows\{112176C2-AB93-4e65-A057-BFF314F665BE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93783ABF-6BCB-4921-BE2A-0EBD89A7FDCF}.exeC:\Windows\{93783ABF-6BCB-4921-BE2A-0EBD89A7FDCF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE49A6D0-78F5-4952-B366-75959C021B0D}.exeC:\Windows\{AE49A6D0-78F5-4952-B366-75959C021B0D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94D38360-376F-4ea4-8EC5-DBB2C65F43B4}.exeC:\Windows\{94D38360-376F-4ea4-8EC5-DBB2C65F43B4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6C1CCF3-71EF-49ec-BDA8-50B5B01035B9}.exeC:\Windows\{B6C1CCF3-71EF-49ec-BDA8-50B5B01035B9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FCE97138-4FA0-438c-93E4-5E1869376732}.exeC:\Windows\{FCE97138-4FA0-438c-93E4-5E1869376732}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D1AC053A-98B7-4872-9183-B94F43129A68}.exeC:\Windows\{D1AC053A-98B7-4872-9183-B94F43129A68}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B52A866C-48AE-4330-87EA-CCBF9376F595}.exeC:\Windows\{B52A866C-48AE-4330-87EA-CCBF9376F595}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D5F18087-BA3C-45b1-A91C-68828EF72D0F}.exeC:\Windows\{D5F18087-BA3C-45b1-A91C-68828EF72D0F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AC39B4EE-6C52-4a2a-9672-CB22B1EB981A}.exeC:\Windows\{AC39B4EE-6C52-4a2a-9672-CB22B1EB981A}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5F18~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B52A8~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D1AC0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FCE97~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6C1C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{94D38~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE49A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93783~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11217~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67DC3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{112176C2-AB93-4e65-A057-BFF314F665BE}.exe
{67DC38A6-1AC7-4322-A738-D972E0812888}.exe
{93783ABF-6BCB-4921-BE2A-0EBD89A7FDCF}.exe
{94D38360-376F-4ea4-8EC5-DBB2C65F43B4}.exe
{AC39B4EE-6C52-4a2a-9672-CB22B1EB981A}.exe
{AE49A6D0-78F5-4952-B366-75959C021B0D}.exe
{B52A866C-48AE-4330-87EA-CCBF9376F595}.exe
{B6C1CCF3-71EF-49ec-BDA8-50B5B01035B9}.exe
{D1AC053A-98B7-4872-9183-B94F43129A68}.exe
{D5F18087-BA3C-45b1-A91C-68828EF72D0F}.exe
{FCE97138-4FA0-438c-93E4-5E1869376732}.exe
memory/648-64-0x0000000000890000-0x000000000094F000-memory.dmp
memory/648-60-0x0000000000890000-0x000000000094F000-memory.dmp
memory/956-10-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/956-6-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/1160-0-0x00000000009B0000-0x0000000000A6F000-memory.dmp
memory/1160-4-0x00000000009B0000-0x0000000000A6F000-memory.dmp
memory/1644-52-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/1644-48-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/3696-28-0x00000000009D0000-0x0000000000A8F000-memory.dmp
memory/3696-24-0x00000000009D0000-0x0000000000A8F000-memory.dmp
memory/4252-46-0x00000000009D0000-0x0000000000A8F000-memory.dmp
memory/4252-42-0x00000000009D0000-0x0000000000A8F000-memory.dmp
memory/4336-34-0x0000000000680000-0x000000000073F000-memory.dmp
memory/4336-30-0x0000000000680000-0x000000000073F000-memory.dmp
memory/4688-40-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/4688-36-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/4708-54-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4708-59-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4732-22-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/4732-18-0x00000000008B0000-0x000000000096F000-memory.dmp
memory/5076-16-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/5076-12-0x00000000008D0000-0x000000000098F000-memory.dmp