Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
02/05/2026, 16:49
General
- Target 2026-05-02_71f96fc77ec547bc7a685e6c3a41c86b_elex_wannacry.exe
- Size 59KB
- Sample260502-vb5ssscv2s
- SHA256 eef9344c4c520fe253bc4de0fa7e316fe67a805fbc898d5bb2e52e540c2e6f6c
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-02_71f96fc77ec547bc7a685e6c3a41c86b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-02_71f96fc77ec547bc7a685e6c3a41c86b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A4B33B7-E6C1-4198-9870-BCE2533A6571}.exeC:\Windows\{8A4B33B7-E6C1-4198-9870-BCE2533A6571}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2A7E6CC2-72B3-4ad4-8497-173E44072444}.exeC:\Windows\{2A7E6CC2-72B3-4ad4-8497-173E44072444}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EC56135-6B01-4044-BFB1-BA2019EBDD9E}.exeC:\Windows\{0EC56135-6B01-4044-BFB1-BA2019EBDD9E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2804B8BC-9459-4605-92F9-95B4EC2E771D}.exeC:\Windows\{2804B8BC-9459-4605-92F9-95B4EC2E771D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{449E92CC-3331-4e36-AFAC-F981EF534B0D}.exeC:\Windows\{449E92CC-3331-4e36-AFAC-F981EF534B0D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09FB4D72-6615-4268-8FCC-807C81A4FB21}.exeC:\Windows\{09FB4D72-6615-4268-8FCC-807C81A4FB21}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48C1427F-829D-4550-B7BA-131B8533080A}.exeC:\Windows\{48C1427F-829D-4550-B7BA-131B8533080A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDC49EF6-6C8D-42c6-B4A1-4E799679300E}.exeC:\Windows\{CDC49EF6-6C8D-42c6-B4A1-4E799679300E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D51CC6A0-D517-4189-B50D-BA5B50669990}.exeC:\Windows\{D51CC6A0-D517-4189-B50D-BA5B50669990}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8F21F44-CF4F-488d-AB75-70CE86242FD7}.exeC:\Windows\{B8F21F44-CF4F-488d-AB75-70CE86242FD7}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D51CC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDC49~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48C14~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09FB4~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{449E9~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2804B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EC56~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2A7E6~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A4B3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{09FB4D72-6615-4268-8FCC-807C81A4FB21}.exe
{0EC56135-6B01-4044-BFB1-BA2019EBDD9E}.exe
{2804B8BC-9459-4605-92F9-95B4EC2E771D}.exe
{2A7E6CC2-72B3-4ad4-8497-173E44072444}.exe
{449E92CC-3331-4e36-AFAC-F981EF534B0D}.exe
{48C1427F-829D-4550-B7BA-131B8533080A}.exe
{8A4B33B7-E6C1-4198-9870-BCE2533A6571}.exe
{B8F21F44-CF4F-488d-AB75-70CE86242FD7}.exe
{CDC49EF6-6C8D-42c6-B4A1-4E799679300E}.exe
{D51CC6A0-D517-4189-B50D-BA5B50669990}.exe
memory/2500-42-0x0000000000820000-0x00000000008BC000-memory.dmp
memory/2500-46-0x0000000000820000-0x00000000008BC000-memory.dmp
memory/2912-36-0x00000000008B0000-0x000000000094C000-memory.dmp
memory/2912-40-0x00000000008B0000-0x000000000094C000-memory.dmp
memory/3568-16-0x0000000000990000-0x0000000000A2C000-memory.dmp
memory/3568-12-0x0000000000990000-0x0000000000A2C000-memory.dmp
memory/3872-9-0x0000000000630000-0x00000000006CC000-memory.dmp
memory/3872-6-0x0000000000630000-0x00000000006CC000-memory.dmp
memory/3952-54-0x0000000000830000-0x00000000008CC000-memory.dmp
memory/3952-58-0x0000000000830000-0x00000000008CC000-memory.dmp
memory/4648-5-0x00000000009F0000-0x0000000000A8C000-memory.dmp
memory/4648-0-0x00000000009F0000-0x0000000000A8C000-memory.dmp
memory/4760-34-0x00000000009E0000-0x0000000000A7C000-memory.dmp
memory/4760-30-0x00000000009E0000-0x0000000000A7C000-memory.dmp
memory/4772-22-0x0000000000970000-0x0000000000A0C000-memory.dmp
memory/4772-18-0x0000000000970000-0x0000000000A0C000-memory.dmp
memory/5100-28-0x0000000000620000-0x00000000006BC000-memory.dmp
memory/5100-24-0x0000000000620000-0x00000000006BC000-memory.dmp
memory/5176-48-0x0000000000980000-0x0000000000A1C000-memory.dmp
memory/5176-52-0x0000000000980000-0x0000000000A1C000-memory.dmp