Analysis
- max time kernel
150s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
25/04/2026, 16:57
General
- Target 2026-04-25_e46b3bc1ddf6954087ed121441692164_elex_wannacry.exe
- Size 126KB
- Sample260425-vgavlset4t
- SHA256 634ffe20452661e82126c357824f24d1073c377cabe8352df56d2d62f04ac60e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 30 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_e46b3bc1ddf6954087ed121441692164_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_e46b3bc1ddf6954087ed121441692164_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40366D28-5823-4791-AA40-68A462AC6949}.exeC:\Windows\{40366D28-5823-4791-AA40-68A462AC6949}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ECF0430A-85E2-45dc-8AA3-5492F49A3FE9}.exeC:\Windows\{ECF0430A-85E2-45dc-8AA3-5492F49A3FE9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5690CF8D-FF65-4bf5-99DE-FFCEF03EEE53}.exeC:\Windows\{5690CF8D-FF65-4bf5-99DE-FFCEF03EEE53}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DD25017-1A22-40e2-BE43-878CF91BCC75}.exeC:\Windows\{0DD25017-1A22-40e2-BE43-878CF91BCC75}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35F21686-2535-451b-8444-CAB6A725ECAE}.exeC:\Windows\{35F21686-2535-451b-8444-CAB6A725ECAE}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0B2EB02-EEFD-4420-8AE7-2B8E029C5A70}.exeC:\Windows\{D0B2EB02-EEFD-4420-8AE7-2B8E029C5A70}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2DA82FE3-A1B6-4b93-8E77-E6E88B82FE23}.exeC:\Windows\{2DA82FE3-A1B6-4b93-8E77-E6E88B82FE23}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51778229-5612-461d-99C9-D81B19CB680E}.exeC:\Windows\{51778229-5612-461d-99C9-D81B19CB680E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D57EE345-AA81-4b5a-A0E4-933CF60AED59}.exeC:\Windows\{D57EE345-AA81-4b5a-A0E4-933CF60AED59}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8E24B0D0-332F-43c1-BD05-FDADA4216BCD}.exeC:\Windows\{8E24B0D0-332F-43c1-BD05-FDADA4216BCD}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D57EE~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51778~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2DA82~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0B2E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35F21~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0DD25~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5690C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ECF04~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40366~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0DD25017-1A22-40e2-BE43-878CF91BCC75}.exe
{2DA82FE3-A1B6-4b93-8E77-E6E88B82FE23}.exe
{35F21686-2535-451b-8444-CAB6A725ECAE}.exe
{40366D28-5823-4791-AA40-68A462AC6949}.exe
{51778229-5612-461d-99C9-D81B19CB680E}.exe
{5690CF8D-FF65-4bf5-99DE-FFCEF03EEE53}.exe
{8E24B0D0-332F-43c1-BD05-FDADA4216BCD}.exe
{D0B2EB02-EEFD-4420-8AE7-2B8E029C5A70}.exe
{D57EE345-AA81-4b5a-A0E4-933CF60AED59}.exe
{ECF0430A-85E2-45dc-8AA3-5492F49A3FE9}.exe
memory/244-80-0x0000000000880000-0x000000000093B000-memory.dmp
memory/244-79-0x0000000000400000-0x0000000000411000-memory.dmp
memory/844-38-0x0000000000400000-0x0000000000411000-memory.dmp
memory/844-32-0x0000000000400000-0x0000000000411000-memory.dmp
memory/844-33-0x0000000000830000-0x00000000008EB000-memory.dmp
memory/1328-54-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1328-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1328-56-0x0000000000640000-0x00000000006FB000-memory.dmp
memory/1332-44-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1332-40-0x0000000000860000-0x000000000091B000-memory.dmp
memory/2016-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2016-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2016-1-0x0000000000990000-0x0000000000A4B000-memory.dmp
memory/2016-2-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2444-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2444-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2444-10-0x00000000009D0000-0x0000000000A8B000-memory.dmp
memory/2444-16-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2832-18-0x0000000000850000-0x000000000090B000-memory.dmp
memory/2832-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3028-30-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3028-25-0x0000000000850000-0x000000000090B000-memory.dmp
memory/4092-53-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4092-48-0x00000000009A0000-0x0000000000A5B000-memory.dmp
memory/4092-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4628-71-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4628-72-0x0000000000850000-0x000000000090B000-memory.dmp
memory/4628-78-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4640-63-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4640-64-0x00000000008D0000-0x000000000098B000-memory.dmp
memory/4640-70-0x0000000000400000-0x0000000000411000-memory.dmp