Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/05/2026, 13:08
General
- Target 2026-05-03_0c5eb3f84ee5d05e2f5536eaaf327609_elex_wannacry.exe
- Size 60KB
- Sample260503-qdnvvahy6x
- SHA256 ee3cb782b9d3d6a44ef3861302fb1cf888f526f41c41a274ff473732a066d6be
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_0c5eb3f84ee5d05e2f5536eaaf327609_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_0c5eb3f84ee5d05e2f5536eaaf327609_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8C7068D-B8EA-4e7e-A75D-204C4038FCFD}.exeC:\Windows\{B8C7068D-B8EA-4e7e-A75D-204C4038FCFD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F998D674-035A-43dc-99A1-49241C3F9C96}.exeC:\Windows\{F998D674-035A-43dc-99A1-49241C3F9C96}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4BB3223E-A6C2-494c-9CF7-5B9E58EEA295}.exeC:\Windows\{4BB3223E-A6C2-494c-9CF7-5B9E58EEA295}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B22E301-B899-436e-BB49-F3B490D30643}.exeC:\Windows\{0B22E301-B899-436e-BB49-F3B490D30643}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EA2691F-F9AF-4d18-AD76-C90045E37201}.exeC:\Windows\{2EA2691F-F9AF-4d18-AD76-C90045E37201}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{57C9BEC4-B77F-4a35-8E4B-B99C3C320322}.exeC:\Windows\{57C9BEC4-B77F-4a35-8E4B-B99C3C320322}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF34C0FC-5B92-4929-8304-BE95266A06BD}.exeC:\Windows\{EF34C0FC-5B92-4929-8304-BE95266A06BD}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1EF5FBD0-BEBF-46b8-823F-94AE84C809B5}.exeC:\Windows\{1EF5FBD0-BEBF-46b8-823F-94AE84C809B5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8A4587A4-BB0E-4d71-B3B3-FA12978F9182}.exeC:\Windows\{8A4587A4-BB0E-4d71-B3B3-FA12978F9182}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80D7001A-2203-467b-A505-F41E40724108}.exeC:\Windows\{80D7001A-2203-467b-A505-F41E40724108}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7FC5AA6-A887-4b66-A431-8619C1264BBF}.exeC:\Windows\{F7FC5AA6-A887-4b66-A431-8619C1264BBF}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80D70~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8A458~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1EF5F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF34C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{57C9B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EA26~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B22E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4BB32~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F998D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B8C70~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0B22E301-B899-436e-BB49-F3B490D30643}.exe
{1EF5FBD0-BEBF-46b8-823F-94AE84C809B5}.exe
{2EA2691F-F9AF-4d18-AD76-C90045E37201}.exe
{4BB3223E-A6C2-494c-9CF7-5B9E58EEA295}.exe
{57C9BEC4-B77F-4a35-8E4B-B99C3C320322}.exe
{80D7001A-2203-467b-A505-F41E40724108}.exe
{8A4587A4-BB0E-4d71-B3B3-FA12978F9182}.exe
{B8C7068D-B8EA-4e7e-A75D-204C4038FCFD}.exe
{EF34C0FC-5B92-4929-8304-BE95266A06BD}.exe
{F7FC5AA6-A887-4b66-A431-8619C1264BBF}.exe
{F998D674-035A-43dc-99A1-49241C3F9C96}.exe
memory/216-60-0x0000000000520000-0x0000000000595000-memory.dmp
memory/216-64-0x0000000000520000-0x0000000000595000-memory.dmp
memory/768-17-0x0000000000860000-0x00000000008D5000-memory.dmp
memory/768-12-0x0000000000860000-0x00000000008D5000-memory.dmp
memory/2304-45-0x0000000000650000-0x00000000006C5000-memory.dmp
memory/2304-42-0x0000000000650000-0x00000000006C5000-memory.dmp
memory/3508-34-0x0000000000860000-0x00000000008D5000-memory.dmp
memory/3508-30-0x0000000000860000-0x00000000008D5000-memory.dmp
memory/3984-36-0x0000000000650000-0x00000000006C5000-memory.dmp
memory/3984-40-0x0000000000650000-0x00000000006C5000-memory.dmp
memory/4532-0-0x00000000005B0000-0x0000000000625000-memory.dmp
memory/4532-4-0x00000000005B0000-0x0000000000625000-memory.dmp
memory/4932-28-0x0000000000620000-0x0000000000695000-memory.dmp
memory/4932-24-0x0000000000620000-0x0000000000695000-memory.dmp
memory/5108-6-0x0000000000730000-0x00000000007A5000-memory.dmp
memory/5108-10-0x0000000000730000-0x00000000007A5000-memory.dmp
memory/5216-54-0x0000000000640000-0x00000000006B5000-memory.dmp
memory/5216-58-0x0000000000640000-0x00000000006B5000-memory.dmp
memory/5588-51-0x0000000000870000-0x00000000008E5000-memory.dmp
memory/5588-48-0x0000000000870000-0x00000000008E5000-memory.dmp
memory/5732-18-0x0000000000720000-0x0000000000795000-memory.dmp
memory/5732-23-0x0000000000720000-0x0000000000795000-memory.dmp