Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
02/05/2026, 12:33
General
- Target 2026-05-02_81327bb3ef14aa68e154413cc68a788b_elex_wannacry.exe
- Size 64KB
- Sample260502-precwsbv2q
- SHA256 0016e5398efe8fcfdb8b97f89f555320405ec55abd187addc57773c7c98f7258
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 31 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-02_81327bb3ef14aa68e154413cc68a788b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-02_81327bb3ef14aa68e154413cc68a788b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61D731D0-1CBA-4e7d-BC2B-48F8E2B1F78F}.exeC:\Windows\{61D731D0-1CBA-4e7d-BC2B-48F8E2B1F78F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6F2F2144-8A19-4600-9F5C-A8EAA6185B05}.exeC:\Windows\{6F2F2144-8A19-4600-9F5C-A8EAA6185B05}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42AF4BF9-969A-44e2-B33B-7E49F3B25200}.exeC:\Windows\{42AF4BF9-969A-44e2-B33B-7E49F3B25200}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{393091D5-0A3E-44c8-B4BA-7A7E346B5F8B}.exeC:\Windows\{393091D5-0A3E-44c8-B4BA-7A7E346B5F8B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B8B8817-25BB-4f8d-80FD-8D38711043D2}.exeC:\Windows\{4B8B8817-25BB-4f8d-80FD-8D38711043D2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4B36AC5E-3988-4936-8DBB-31A1EA312D5E}.exeC:\Windows\{4B36AC5E-3988-4936-8DBB-31A1EA312D5E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA7D0171-21BD-4436-8761-AC3612E4C904}.exeC:\Windows\{CA7D0171-21BD-4436-8761-AC3612E4C904}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2C871222-57BA-45d6-AE42-BB1671567CE0}.exeC:\Windows\{2C871222-57BA-45d6-AE42-BB1671567CE0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F866A54-2366-4db3-B6B7-15AC46775FD3}.exeC:\Windows\{2F866A54-2366-4db3-B6B7-15AC46775FD3}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{059420AD-3D74-4f81-ABF1-C6328E71A5FC}.exeC:\Windows\{059420AD-3D74-4f81-ABF1-C6328E71A5FC}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F866~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2C871~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA7D0~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B36A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4B8B8~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{39309~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{42AF4~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6F2F2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61D73~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{059420AD-3D74-4f81-ABF1-C6328E71A5FC}.exe
{2C871222-57BA-45d6-AE42-BB1671567CE0}.exe
{2F866A54-2366-4db3-B6B7-15AC46775FD3}.exe
{393091D5-0A3E-44c8-B4BA-7A7E346B5F8B}.exe
{42AF4BF9-969A-44e2-B33B-7E49F3B25200}.exe
{4B36AC5E-3988-4936-8DBB-31A1EA312D5E}.exe
{4B8B8817-25BB-4f8d-80FD-8D38711043D2}.exe
{61D731D0-1CBA-4e7d-BC2B-48F8E2B1F78F}.exe
{6F2F2144-8A19-4600-9F5C-A8EAA6185B05}.exe
{CA7D0171-21BD-4436-8761-AC3612E4C904}.exe
memory/584-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/584-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/584-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1640-59-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1764-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1764-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1944-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1944-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2000-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2000-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2000-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2008-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2332-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2332-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2844-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3344-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3344-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3736-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3736-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4496-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4496-25-0x0000000000400000-0x0000000000410000-memory.dmp