Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
01/05/2026, 17:50
General
- Target 2026-05-01_ae806a18042007e2a81b6db84ae8dd57_elex_wannacry.exe
- Size 176KB
- Sample260501-we2e8aaw4v
- SHA256 520a09f1aebcaf891b58e8f69341fd7a5650bcbfe07640adb4e767d48cc8e637
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-01_ae806a18042007e2a81b6db84ae8dd57_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-01_ae806a18042007e2a81b6db84ae8dd57_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFECB82A-8F97-4983-9B32-71F6DBF56AAE}.exeC:\Windows\{AFECB82A-8F97-4983-9B32-71F6DBF56AAE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C49B8BF1-709B-40be-96CA-D1D3FE2C3799}.exeC:\Windows\{C49B8BF1-709B-40be-96CA-D1D3FE2C3799}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{876B7DAD-8490-4b3c-8967-B32C71332456}.exeC:\Windows\{876B7DAD-8490-4b3c-8967-B32C71332456}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D51555AB-3BE4-4e7b-9AFA-A73967014C45}.exeC:\Windows\{D51555AB-3BE4-4e7b-9AFA-A73967014C45}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97FA151A-D0C3-4cdf-842E-BF568823ECF5}.exeC:\Windows\{97FA151A-D0C3-4cdf-842E-BF568823ECF5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B6679E87-B06A-42f2-9347-C1E35CBCE878}.exeC:\Windows\{B6679E87-B06A-42f2-9347-C1E35CBCE878}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7E4F9C76-E893-485b-93B8-52C01EBDCA9D}.exeC:\Windows\{7E4F9C76-E893-485b-93B8-52C01EBDCA9D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05C1E923-3486-4e3a-B87E-B731BC84CA3F}.exeC:\Windows\{05C1E923-3486-4e3a-B87E-B731BC84CA3F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BC4AD27-EDC7-47ea-8CDA-1BA4870895D7}.exeC:\Windows\{4BC4AD27-EDC7-47ea-8CDA-1BA4870895D7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78AC3F8F-E832-4706-B62E-77B69DEE6E2A}.exeC:\Windows\{78AC3F8F-E832-4706-B62E-77B69DEE6E2A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DA0320E-35E1-4760-8A5F-CA3EE97FA79D}.exeC:\Windows\{0DA0320E-35E1-4760-8A5F-CA3EE97FA79D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78AC3~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BC4A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05C1E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7E4F9~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B6679~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97FA1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5155~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{876B7~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C49B8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFECB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{05C1E923-3486-4e3a-B87E-B731BC84CA3F}.exe
{0DA0320E-35E1-4760-8A5F-CA3EE97FA79D}.exe
{4BC4AD27-EDC7-47ea-8CDA-1BA4870895D7}.exe
{78AC3F8F-E832-4706-B62E-77B69DEE6E2A}.exe
{7E4F9C76-E893-485b-93B8-52C01EBDCA9D}.exe
{876B7DAD-8490-4b3c-8967-B32C71332456}.exe
{97FA151A-D0C3-4cdf-842E-BF568823ECF5}.exe
{AFECB82A-8F97-4983-9B32-71F6DBF56AAE}.exe
{B6679E87-B06A-42f2-9347-C1E35CBCE878}.exe
{C49B8BF1-709B-40be-96CA-D1D3FE2C3799}.exe
{D51555AB-3BE4-4e7b-9AFA-A73967014C45}.exe
memory/1176-22-0x0000000000890000-0x0000000000917000-memory.dmp
memory/1176-18-0x0000000000890000-0x0000000000917000-memory.dmp
memory/1648-36-0x00000000008C0000-0x0000000000947000-memory.dmp
memory/1648-41-0x00000000008C0000-0x0000000000947000-memory.dmp
memory/2696-45-0x00000000007D0000-0x0000000000857000-memory.dmp
memory/2696-42-0x00000000007D0000-0x0000000000857000-memory.dmp
memory/2840-10-0x0000000000630000-0x00000000006B7000-memory.dmp
memory/2840-6-0x0000000000630000-0x00000000006B7000-memory.dmp
memory/3832-54-0x0000000000920000-0x00000000009A7000-memory.dmp
memory/3832-57-0x0000000000920000-0x00000000009A7000-memory.dmp
memory/4712-51-0x00000000008A0000-0x0000000000927000-memory.dmp
memory/4712-48-0x00000000008A0000-0x0000000000927000-memory.dmp
memory/4748-17-0x00000000007B0000-0x0000000000837000-memory.dmp
memory/4748-12-0x00000000007B0000-0x0000000000837000-memory.dmp
memory/4880-0-0x00000000009C0000-0x0000000000A47000-memory.dmp
memory/4880-5-0x00000000009C0000-0x0000000000A47000-memory.dmp
memory/5148-60-0x0000000000450000-0x00000000004D7000-memory.dmp
memory/5148-64-0x0000000000450000-0x00000000004D7000-memory.dmp
memory/5372-28-0x0000000000680000-0x0000000000707000-memory.dmp
memory/5372-24-0x0000000000680000-0x0000000000707000-memory.dmp
memory/5524-35-0x00000000007A0000-0x0000000000827000-memory.dmp
memory/5524-30-0x00000000007A0000-0x0000000000827000-memory.dmp