Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 16:06
General
- Target 2026-04-25_cdb6bad8aad1b9f26728fabde2c0f8f1_elex_wannacry.exe
- Size 60KB
- Sample260425-tkfdtsc17z
- SHA256 6f0265fe7e20fb2a0e829f5c3d2636aa28adfb98b71e41b7d206b6b49dd5bf9a
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Detects Windows executables referencing non-Windows User-Agents 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_cdb6bad8aad1b9f26728fabde2c0f8f1_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_cdb6bad8aad1b9f26728fabde2c0f8f1_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CC97506-7AF1-48ad-A5FA-B455CDCC12B2}.exeC:\Windows\{2CC97506-7AF1-48ad-A5FA-B455CDCC12B2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A33B1797-BF43-4603-AB23-21B1FAFC81E3}.exeC:\Windows\{A33B1797-BF43-4603-AB23-21B1FAFC81E3}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EADF102D-080D-437b-9798-0A42C6440E58}.exeC:\Windows\{EADF102D-080D-437b-9798-0A42C6440E58}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{108578C7-14DD-4582-83A3-57526D95C2B6}.exeC:\Windows\{108578C7-14DD-4582-83A3-57526D95C2B6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE2215DE-E496-474b-B50F-7F5BCA21E968}.exeC:\Windows\{CE2215DE-E496-474b-B50F-7F5BCA21E968}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78B92D33-7F2F-4b68-BB26-92FCBBD5341D}.exeC:\Windows\{78B92D33-7F2F-4b68-BB26-92FCBBD5341D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4AB2CA1D-45C1-4885-B992-679D3697220E}.exeC:\Windows\{4AB2CA1D-45C1-4885-B992-679D3697220E}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2353255B-4090-4469-A453-956C188692C9}.exeC:\Windows\{2353255B-4090-4469-A453-956C188692C9}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6246C35-666B-457c-A554-C6C465ADE2C7}.exeC:\Windows\{D6246C35-666B-457c-A554-C6C465ADE2C7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5344E00-135B-476a-9A2E-813CE32CE480}.exeC:\Windows\{A5344E00-135B-476a-9A2E-813CE32CE480}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6246~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23532~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AB2C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78B92~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE221~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10857~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EADF1~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A33B1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CC97~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{108578C7-14DD-4582-83A3-57526D95C2B6}.exe
{2353255B-4090-4469-A453-956C188692C9}.exe
{2CC97506-7AF1-48ad-A5FA-B455CDCC12B2}.exe
{4AB2CA1D-45C1-4885-B992-679D3697220E}.exe
{78B92D33-7F2F-4b68-BB26-92FCBBD5341D}.exe
{A33B1797-BF43-4603-AB23-21B1FAFC81E3}.exe
{A5344E00-135B-476a-9A2E-813CE32CE480}.exe
{CE2215DE-E496-474b-B50F-7F5BCA21E968}.exe
{D6246C35-666B-457c-A554-C6C465ADE2C7}.exe
{EADF102D-080D-437b-9798-0A42C6440E58}.exe