Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
02/05/2026, 14:37
General
- Target 2026-05-02_1781b0d22533fd775170708dcad25e6c_elex_wannacry.exe
- Size 116KB
- Sample260502-ry63laev8j
- SHA256 fbaf4f5918b9b4bca1af8dea71eec9fe4965cdd38a5ed534403be890ea0f54a7
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 7 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 7 IoCs
- Drops file in Windows directory 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-02_1781b0d22533fd775170708dcad25e6c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-02_1781b0d22533fd775170708dcad25e6c_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64D19BFB-823A-46ff-9D8B-6E583E3FAA6F}.exeC:\Windows\{64D19BFB-823A-46ff-9D8B-6E583E3FAA6F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D761B5C8-4F91-4c93-9997-14456F764E0E}.exeC:\Windows\{D761B5C8-4F91-4c93-9997-14456F764E0E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E560693F-B140-40f7-BE45-B1EF9947FAB1}.exeC:\Windows\{E560693F-B140-40f7-BE45-B1EF9947FAB1}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2E9F3DF2-15B2-4594-A815-3CCB6F0AF03B}.exeC:\Windows\{2E9F3DF2-15B2-4594-A815-3CCB6F0AF03B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9458665-D610-456d-941D-E45550657DD6}.exeC:\Windows\{D9458665-D610-456d-941D-E45550657DD6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6147A489-D42F-4f6c-AA62-4927AFACBFD9}.exeC:\Windows\{6147A489-D42F-4f6c-AA62-4927AFACBFD9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{535E889C-C03C-4ba8-B623-806BDC2C684F}.exeC:\Windows\{535E889C-C03C-4ba8-B623-806BDC2C684F}.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6147A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9458~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2E9F3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5606~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D761B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64D19~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2E9F3DF2-15B2-4594-A815-3CCB6F0AF03B}.exe
{535E889C-C03C-4ba8-B623-806BDC2C684F}.exe
{6147A489-D42F-4f6c-AA62-4927AFACBFD9}.exe
{64D19BFB-823A-46ff-9D8B-6E583E3FAA6F}.exe
{D761B5C8-4F91-4c93-9997-14456F764E0E}.exe
{D9458665-D610-456d-941D-E45550657DD6}.exe
{E560693F-B140-40f7-BE45-B1EF9947FAB1}.exe
memory/708-30-0x00000000008C0000-0x0000000000935000-memory.dmp
memory/708-33-0x00000000008C0000-0x0000000000935000-memory.dmp
memory/1080-42-0x0000000000770000-0x00000000007E5000-memory.dmp
memory/1672-12-0x0000000000870000-0x00000000008E5000-memory.dmp
memory/1672-16-0x0000000000870000-0x00000000008E5000-memory.dmp
memory/1728-18-0x0000000000580000-0x00000000005F5000-memory.dmp
memory/1728-21-0x0000000000580000-0x00000000005F5000-memory.dmp
memory/2692-6-0x0000000000720000-0x0000000000795000-memory.dmp
memory/2692-11-0x0000000000720000-0x0000000000795000-memory.dmp
memory/2736-36-0x0000000000690000-0x0000000000705000-memory.dmp
memory/2736-41-0x0000000000690000-0x0000000000705000-memory.dmp
memory/3140-28-0x00000000005C0000-0x0000000000635000-memory.dmp
memory/3140-24-0x00000000005C0000-0x0000000000635000-memory.dmp
memory/3680-0-0x00000000009A0000-0x0000000000A15000-memory.dmp
memory/3680-5-0x00000000009A0000-0x0000000000A15000-memory.dmp