Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
26/04/2026, 10:46
General
- Target 2026-04-26_a96dc432ff6bc5f45d243225174b536d_elex_wannacry.exe
- Size 60KB
- Sample260426-mt4z8aev2y
- SHA256 9aca7871141df74b608829e37c81e84ae76658d90d34ebf32ce445f4f47a740a
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-26_a96dc432ff6bc5f45d243225174b536d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-26_a96dc432ff6bc5f45d243225174b536d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B233BC4-CEE4-42b0-8E11-6D595216829B}.exeC:\Windows\{3B233BC4-CEE4-42b0-8E11-6D595216829B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B6C815C-6701-42c7-8A04-C675DB17406E}.exeC:\Windows\{1B6C815C-6701-42c7-8A04-C675DB17406E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74563467-CC08-45af-BCAE-C118CF117B50}.exeC:\Windows\{74563467-CC08-45af-BCAE-C118CF117B50}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57A26D16-F2BE-42cc-988D-7895880D33C6}.exeC:\Windows\{57A26D16-F2BE-42cc-988D-7895880D33C6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B332625-DB83-46e1-B076-80E7624340D5}.exeC:\Windows\{9B332625-DB83-46e1-B076-80E7624340D5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C777E2FF-E85F-49c1-ADBE-8C4FBFB5CC66}.exeC:\Windows\{C777E2FF-E85F-49c1-ADBE-8C4FBFB5CC66}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9ED6C52E-8CAE-47bd-9401-FC190D548963}.exeC:\Windows\{9ED6C52E-8CAE-47bd-9401-FC190D548963}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A56570FB-E226-48b4-9717-5356CC07D8D2}.exeC:\Windows\{A56570FB-E226-48b4-9717-5356CC07D8D2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F279EBDB-E384-4403-8666-BFE56AEC3788}.exeC:\Windows\{F279EBDB-E384-4403-8666-BFE56AEC3788}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0258312A-B585-490a-A592-44B4816C0D47}.exeC:\Windows\{0258312A-B585-490a-A592-44B4816C0D47}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0DF0AB8-9604-4872-BD6E-60C99358FB4E}.exeC:\Windows\{D0DF0AB8-9604-4872-BD6E-60C99358FB4E}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02583~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F279E~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5657~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9ED6C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C777E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B332~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57A26~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74563~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B6C8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B233~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0258312A-B585-490a-A592-44B4816C0D47}.exe
{1B6C815C-6701-42c7-8A04-C675DB17406E}.exe
{3B233BC4-CEE4-42b0-8E11-6D595216829B}.exe
{57A26D16-F2BE-42cc-988D-7895880D33C6}.exe
{74563467-CC08-45af-BCAE-C118CF117B50}.exe
{9B332625-DB83-46e1-B076-80E7624340D5}.exe
{9ED6C52E-8CAE-47bd-9401-FC190D548963}.exe
{A56570FB-E226-48b4-9717-5356CC07D8D2}.exe
{C777E2FF-E85F-49c1-ADBE-8C4FBFB5CC66}.exe
{D0DF0AB8-9604-4872-BD6E-60C99358FB4E}.exe
{F279EBDB-E384-4403-8666-BFE56AEC3788}.exe
memory/828-22-0x0000000000510000-0x0000000000535000-memory.dmp
memory/828-18-0x0000000000510000-0x0000000000535000-memory.dmp
memory/972-24-0x00000000005A0000-0x00000000005C5000-memory.dmp
memory/972-29-0x00000000005A0000-0x00000000005C5000-memory.dmp
memory/1048-0-0x0000000000590000-0x00000000005B5000-memory.dmp
memory/1048-5-0x0000000000590000-0x00000000005B5000-memory.dmp
memory/1140-60-0x0000000000560000-0x0000000000585000-memory.dmp
memory/1140-64-0x0000000000560000-0x0000000000585000-memory.dmp
memory/1804-36-0x0000000000940000-0x0000000000965000-memory.dmp
memory/1804-40-0x0000000000940000-0x0000000000965000-memory.dmp
memory/2568-48-0x0000000000560000-0x0000000000585000-memory.dmp
memory/2568-52-0x0000000000560000-0x0000000000585000-memory.dmp
memory/2724-35-0x0000000000640000-0x0000000000665000-memory.dmp
memory/2724-30-0x0000000000640000-0x0000000000665000-memory.dmp
memory/3680-16-0x0000000000620000-0x0000000000645000-memory.dmp
memory/3680-12-0x0000000000620000-0x0000000000645000-memory.dmp
memory/3948-10-0x0000000000A70000-0x0000000000A95000-memory.dmp
memory/3948-6-0x0000000000A70000-0x0000000000A95000-memory.dmp
memory/4408-54-0x0000000000520000-0x0000000000545000-memory.dmp
memory/4408-58-0x0000000000520000-0x0000000000545000-memory.dmp
memory/4432-42-0x0000000000510000-0x0000000000535000-memory.dmp
memory/4432-46-0x0000000000510000-0x0000000000535000-memory.dmp