Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 15:13
General
- Target 2026-04-25_4758fceb1d40248ad806f1f9facbec06_elex_wannacry.exe
- Size 59KB
- Sample260425-sl87vscs2v
- SHA256 c78a1398b0224f8a5cf080c5798c1a1923527f375f312c9913d427226cf9522d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Detects Windows executables referencing non-Windows User-Agents 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_4758fceb1d40248ad806f1f9facbec06_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_4758fceb1d40248ad806f1f9facbec06_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5F8333A0-F13E-40d6-BD4F-2C4E15B313D4}.exeC:\Windows\{5F8333A0-F13E-40d6-BD4F-2C4E15B313D4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40906A04-4245-45c4-96DB-8E41B8E14529}.exeC:\Windows\{40906A04-4245-45c4-96DB-8E41B8E14529}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{229629BD-A0EC-4111-BA9C-A54B68990A3D}.exeC:\Windows\{229629BD-A0EC-4111-BA9C-A54B68990A3D}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA2B59B0-4A11-40c4-A6E8-6E08BB0E32DC}.exeC:\Windows\{EA2B59B0-4A11-40c4-A6E8-6E08BB0E32DC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAF679EC-19A5-4875-9D06-87056D13E225}.exeC:\Windows\{BAF679EC-19A5-4875-9D06-87056D13E225}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8BB85AAA-4068-4ee6-B8FC-785A0C536BCA}.exeC:\Windows\{8BB85AAA-4068-4ee6-B8FC-785A0C536BCA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{616BFFE9-05B8-47c1-ADE4-2062BD44F2B9}.exeC:\Windows\{616BFFE9-05B8-47c1-ADE4-2062BD44F2B9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C49EDD7E-2115-49df-A5C4-3B892CC29B5F}.exeC:\Windows\{C49EDD7E-2115-49df-A5C4-3B892CC29B5F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6E25D345-510E-463e-8FC2-E595448041A2}.exeC:\Windows\{6E25D345-510E-463e-8FC2-E595448041A2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D54317A2-B14E-4fa1-A698-C167128D685D}.exeC:\Windows\{D54317A2-B14E-4fa1-A698-C167128D685D}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6E25D~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C49ED~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{616BF~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8BB85~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAF67~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA2B5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{22962~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40906~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5F833~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{229629BD-A0EC-4111-BA9C-A54B68990A3D}.exe
{40906A04-4245-45c4-96DB-8E41B8E14529}.exe
{5F8333A0-F13E-40d6-BD4F-2C4E15B313D4}.exe
{616BFFE9-05B8-47c1-ADE4-2062BD44F2B9}.exe
{6E25D345-510E-463e-8FC2-E595448041A2}.exe
{8BB85AAA-4068-4ee6-B8FC-785A0C536BCA}.exe
{BAF679EC-19A5-4875-9D06-87056D13E225}.exe
{C49EDD7E-2115-49df-A5C4-3B892CC29B5F}.exe
{D54317A2-B14E-4fa1-A698-C167128D685D}.exe
{EA2B59B0-4A11-40c4-A6E8-6E08BB0E32DC}.exe
memory/1784-6-0x0000000000860000-0x0000000000921000-memory.dmp
memory/1784-10-0x0000000000860000-0x0000000000921000-memory.dmp
memory/2220-42-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/2220-46-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/2620-30-0x0000000000980000-0x0000000000A41000-memory.dmp
memory/2620-34-0x0000000000980000-0x0000000000A41000-memory.dmp
memory/2780-36-0x00000000009D0000-0x0000000000A91000-memory.dmp
memory/2780-40-0x00000000009D0000-0x0000000000A91000-memory.dmp
memory/2944-59-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/2944-54-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/3328-0-0x0000000000AD0000-0x0000000000B91000-memory.dmp
memory/3328-5-0x0000000000AD0000-0x0000000000B91000-memory.dmp
memory/3536-18-0x0000000000870000-0x0000000000931000-memory.dmp
memory/3536-22-0x0000000000870000-0x0000000000931000-memory.dmp
memory/3564-16-0x0000000000970000-0x0000000000A31000-memory.dmp
memory/3564-12-0x0000000000970000-0x0000000000A31000-memory.dmp
memory/3660-24-0x0000000000970000-0x0000000000A31000-memory.dmp
memory/3660-28-0x0000000000970000-0x0000000000A31000-memory.dmp
memory/4332-48-0x0000000000820000-0x00000000008E1000-memory.dmp
memory/4332-52-0x0000000000820000-0x00000000008E1000-memory.dmp