Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 14:36
General
- Target 2026-05-03_1004baa979361bcda88fe8b63eb8000c_elex_wannacry.exe
- Size 167KB
- Sample260503-ryrynsbt71
- SHA256 e4d0ea457b41e9ac29fc79fe02eb0fdc3c37a6693216fb8055a18b99a9346ddd
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_1004baa979361bcda88fe8b63eb8000c_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_1004baa979361bcda88fe8b63eb8000c_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CA08364-1C67-48b6-BC59-5345E7CCD0A4}.exeC:\Windows\{8CA08364-1C67-48b6-BC59-5345E7CCD0A4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C42BBF4B-FB90-413f-9839-75DE3F0B1C32}.exeC:\Windows\{C42BBF4B-FB90-413f-9839-75DE3F0B1C32}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6EC05E2-0D2F-4e31-A0F7-7E3F46B527FB}.exeC:\Windows\{C6EC05E2-0D2F-4e31-A0F7-7E3F46B527FB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D093ED14-C781-4d06-B225-0DAEB000A6E8}.exeC:\Windows\{D093ED14-C781-4d06-B225-0DAEB000A6E8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D51243FE-2E3B-402f-83B0-C2CD0B01E1D9}.exeC:\Windows\{D51243FE-2E3B-402f-83B0-C2CD0B01E1D9}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4DBAB3F-1125-459d-B2B5-E166B8887925}.exeC:\Windows\{A4DBAB3F-1125-459d-B2B5-E166B8887925}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{578A4983-E014-4fa8-8757-5F09DD21CC2D}.exeC:\Windows\{578A4983-E014-4fa8-8757-5F09DD21CC2D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB30C68F-1CE8-4c53-98BF-F6D685AF2B08}.exeC:\Windows\{BB30C68F-1CE8-4c53-98BF-F6D685AF2B08}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D16E2591-CA56-4214-9337-0B55BFA83C0C}.exeC:\Windows\{D16E2591-CA56-4214-9337-0B55BFA83C0C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E2F8501-A89D-437b-868D-2570F4C98A13}.exeC:\Windows\{5E2F8501-A89D-437b-868D-2570F4C98A13}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D16E2~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB30C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{578A4~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4DBA~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5124~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D093E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6EC0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C42BB~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CA08~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{578A4983-E014-4fa8-8757-5F09DD21CC2D}.exe
{5E2F8501-A89D-437b-868D-2570F4C98A13}.exe
{8CA08364-1C67-48b6-BC59-5345E7CCD0A4}.exe
{A4DBAB3F-1125-459d-B2B5-E166B8887925}.exe
{BB30C68F-1CE8-4c53-98BF-F6D685AF2B08}.exe
{C42BBF4B-FB90-413f-9839-75DE3F0B1C32}.exe
{C6EC05E2-0D2F-4e31-A0F7-7E3F46B527FB}.exe
{D093ED14-C781-4d06-B225-0DAEB000A6E8}.exe
{D16E2591-CA56-4214-9337-0B55BFA83C0C}.exe
{D51243FE-2E3B-402f-83B0-C2CD0B01E1D9}.exe
memory/2376-52-0x0000000000840000-0x0000000000E42000-memory.dmp
memory/2376-48-0x0000000000840000-0x0000000000E42000-memory.dmp
memory/2692-5-0x00000000009C0000-0x0000000000FC2000-memory.dmp
memory/2692-0-0x00000000009C0000-0x0000000000FC2000-memory.dmp
memory/2912-18-0x00000000008B0000-0x0000000000EB2000-memory.dmp
memory/2912-22-0x00000000008B0000-0x0000000000EB2000-memory.dmp
memory/2984-9-0x00000000008B0000-0x0000000000EB2000-memory.dmp
memory/2984-6-0x00000000008B0000-0x0000000000EB2000-memory.dmp
memory/3564-42-0x00000000008F0000-0x0000000000EF2000-memory.dmp
memory/3564-47-0x00000000008F0000-0x0000000000EF2000-memory.dmp
memory/5008-15-0x0000000000840000-0x0000000000E42000-memory.dmp
memory/5008-12-0x0000000000840000-0x0000000000E42000-memory.dmp
memory/5192-34-0x0000000000840000-0x0000000000E42000-memory.dmp
memory/5192-30-0x0000000000840000-0x0000000000E42000-memory.dmp
memory/5280-28-0x0000000000840000-0x0000000000E42000-memory.dmp
memory/5280-24-0x0000000000840000-0x0000000000E42000-memory.dmp
memory/5332-54-0x0000000000850000-0x0000000000E52000-memory.dmp
memory/5332-57-0x0000000000850000-0x0000000000E52000-memory.dmp
memory/5840-36-0x0000000000890000-0x0000000000E92000-memory.dmp
memory/5840-40-0x0000000000890000-0x0000000000E92000-memory.dmp