Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
02/05/2026, 12:33
General
- Target 2026-05-02_81327bb3ef14aa68e154413cc68a788b_elex_wannacry.exe
- Size 64KB
- Sample260502-precwsbv2q
- SHA256 0016e5398efe8fcfdb8b97f89f555320405ec55abd187addc57773c7c98f7258
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 34 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-02_81327bb3ef14aa68e154413cc68a788b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-02_81327bb3ef14aa68e154413cc68a788b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC914A49-7B1C-4a4e-9173-FD3033DCB5E7}.exeC:\Windows\{DC914A49-7B1C-4a4e-9173-FD3033DCB5E7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3056DC77-0BEA-4e16-AF5F-189DA8224565}.exeC:\Windows\{3056DC77-0BEA-4e16-AF5F-189DA8224565}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CCB1F28E-AB44-4cd8-9688-C263FE619221}.exeC:\Windows\{CCB1F28E-AB44-4cd8-9688-C263FE619221}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{41886641-1928-4836-8472-A0836ADDD502}.exeC:\Windows\{41886641-1928-4836-8472-A0836ADDD502}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB501DDA-40C9-412a-B432-33CB5001D3C7}.exeC:\Windows\{DB501DDA-40C9-412a-B432-33CB5001D3C7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9DB9CEC5-B793-4ad4-9AD1-344FF72B2018}.exeC:\Windows\{9DB9CEC5-B793-4ad4-9AD1-344FF72B2018}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CAF27AD9-3781-4b45-A89F-DA64CED42647}.exeC:\Windows\{CAF27AD9-3781-4b45-A89F-DA64CED42647}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9FC56824-B05A-4f4c-81E9-1C7BD0E0C357}.exeC:\Windows\{9FC56824-B05A-4f4c-81E9-1C7BD0E0C357}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBD0B3F5-D9C9-451c-B24F-E8D0F250C5EA}.exeC:\Windows\{CBD0B3F5-D9C9-451c-B24F-E8D0F250C5EA}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{36CF2248-122D-41cf-A46A-6EEE6CDD36B4}.exeC:\Windows\{36CF2248-122D-41cf-A46A-6EEE6CDD36B4}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B453EB8B-BF0D-47f6-B022-6B9F9CC95DFA}.exeC:\Windows\{B453EB8B-BF0D-47f6-B022-6B9F9CC95DFA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{36CF2~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBD0B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FC56~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CAF27~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DB9C~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB501~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{41886~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CCB1F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3056D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC914~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3056DC77-0BEA-4e16-AF5F-189DA8224565}.exe
{36CF2248-122D-41cf-A46A-6EEE6CDD36B4}.exe
{41886641-1928-4836-8472-A0836ADDD502}.exe
{9DB9CEC5-B793-4ad4-9AD1-344FF72B2018}.exe
{9FC56824-B05A-4f4c-81E9-1C7BD0E0C357}.exe
{B453EB8B-BF0D-47f6-B022-6B9F9CC95DFA}.exe
{CAF27AD9-3781-4b45-A89F-DA64CED42647}.exe
{CBD0B3F5-D9C9-451c-B24F-E8D0F250C5EA}.exe
{CCB1F28E-AB44-4cd8-9688-C263FE619221}.exe
{DB501DDA-40C9-412a-B432-33CB5001D3C7}.exe
{DC914A49-7B1C-4a4e-9173-FD3033DCB5E7}.exe
memory/1228-80-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1228-81-0x0000000003BA0000-0x0000000003C03000-memory.dmp
memory/1228-85-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1228-84-0x0000000003BA0000-0x0000000003C03000-memory.dmp
memory/1500-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1500-10-0x0000000002150000-0x00000000021B3000-memory.dmp
memory/1500-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1500-15-0x0000000002150000-0x00000000021B3000-memory.dmp
memory/2376-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2376-57-0x0000000002170000-0x00000000021D3000-memory.dmp
memory/2376-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2376-61-0x0000000002170000-0x00000000021D3000-memory.dmp
memory/2744-41-0x0000000003CD0000-0x0000000003D33000-memory.dmp
memory/2744-45-0x0000000003CD0000-0x0000000003D33000-memory.dmp
memory/2744-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3536-72-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3536-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3536-76-0x0000000003BB0000-0x0000000003C13000-memory.dmp
memory/3536-73-0x0000000003BB0000-0x0000000003C13000-memory.dmp
memory/3868-21-0x0000000003B60000-0x0000000003BC3000-memory.dmp
memory/3868-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3868-18-0x0000000003B60000-0x0000000003BC3000-memory.dmp
memory/3868-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4596-1-0x00000000022B0000-0x0000000002313000-memory.dmp
memory/4596-2-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4596-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4596-8-0x00000000022B0000-0x0000000002313000-memory.dmp
memory/4596-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4904-30-0x0000000002110000-0x0000000002173000-memory.dmp
memory/4904-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4904-26-0x0000000002110000-0x0000000002173000-memory.dmp
memory/4904-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5416-87-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5736-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5736-49-0x0000000003BB0000-0x0000000003C13000-memory.dmp
memory/5736-55-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5736-54-0x0000000003BB0000-0x0000000003C13000-memory.dmp
memory/5760-68-0x0000000003C80000-0x0000000003CE3000-memory.dmp
memory/5760-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5760-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5760-65-0x0000000003C80000-0x0000000003CE3000-memory.dmp
memory/5868-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5868-34-0x0000000002100000-0x0000000002163000-memory.dmp
memory/5868-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5868-39-0x0000000002100000-0x0000000002163000-memory.dmp