Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 15:02
General
- Target 2026-05-03_6800e5d9cf1092630e9b7b1ba4a8dca2_elex_wannacry.exe
- Size 103KB
- Sample260503-seq3psbx6z
- SHA256 d955ea16e1c57ed0329be54259d55552f6ece818ca7f78c3f43200c8ce9772eb
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_6800e5d9cf1092630e9b7b1ba4a8dca2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_6800e5d9cf1092630e9b7b1ba4a8dca2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AB6968A-05D1-486e-B47A-856394157D16}.exeC:\Windows\{8AB6968A-05D1-486e-B47A-856394157D16}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{25B7F8CC-DB0D-438c-9F6B-60076417DD4F}.exeC:\Windows\{25B7F8CC-DB0D-438c-9F6B-60076417DD4F}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84B14D6F-3552-494a-88CD-FF270C3A850E}.exeC:\Windows\{84B14D6F-3552-494a-88CD-FF270C3A850E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDA915E4-4C58-43b4-8502-D0D3A056F560}.exeC:\Windows\{CDA915E4-4C58-43b4-8502-D0D3A056F560}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A724B15-CEA5-4064-9FA2-D56459AAEE1E}.exeC:\Windows\{7A724B15-CEA5-4064-9FA2-D56459AAEE1E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF691D4B-8DCF-49a6-811B-8FCE79546FB5}.exeC:\Windows\{CF691D4B-8DCF-49a6-811B-8FCE79546FB5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CA7C2A5-2CA6-4c33-BC67-0254E4DD0E22}.exeC:\Windows\{2CA7C2A5-2CA6-4c33-BC67-0254E4DD0E22}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89987C65-9BE6-404b-AB6D-A9AA827543E9}.exeC:\Windows\{89987C65-9BE6-404b-AB6D-A9AA827543E9}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E926C52A-937D-4156-92F7-6A03C19DFCC7}.exeC:\Windows\{E926C52A-937D-4156-92F7-6A03C19DFCC7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{520F1936-F436-4411-95D8-C1F5F7D9094B}.exeC:\Windows\{520F1936-F436-4411-95D8-C1F5F7D9094B}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E926C~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89987~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CA7C~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF691~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A724~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDA91~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84B14~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{25B7F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AB69~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{25B7F8CC-DB0D-438c-9F6B-60076417DD4F}.exe
{2CA7C2A5-2CA6-4c33-BC67-0254E4DD0E22}.exe
{520F1936-F436-4411-95D8-C1F5F7D9094B}.exe
{7A724B15-CEA5-4064-9FA2-D56459AAEE1E}.exe
{84B14D6F-3552-494a-88CD-FF270C3A850E}.exe
{89987C65-9BE6-404b-AB6D-A9AA827543E9}.exe
{8AB6968A-05D1-486e-B47A-856394157D16}.exe
{CDA915E4-4C58-43b4-8502-D0D3A056F560}.exe
{CF691D4B-8DCF-49a6-811B-8FCE79546FB5}.exe
{E926C52A-937D-4156-92F7-6A03C19DFCC7}.exe
memory/1788-0-0x0000000000960000-0x00000000009DC000-memory.dmp
memory/2640-18-0x00000000009C0000-0x0000000000A3C000-memory.dmp
memory/2976-60-0x00000000008B0000-0x000000000092C000-memory.dmp
memory/3912-54-0x00000000009A0000-0x0000000000A1C000-memory.dmp
memory/3952-6-0x0000000000850000-0x00000000008CC000-memory.dmp
memory/4068-42-0x0000000000860000-0x00000000008DC000-memory.dmp
memory/4080-36-0x0000000000990000-0x0000000000A0C000-memory.dmp
memory/4404-48-0x0000000000840000-0x00000000008BC000-memory.dmp
memory/4656-30-0x00000000009C0000-0x0000000000A3C000-memory.dmp
memory/4700-12-0x0000000000830000-0x00000000008AC000-memory.dmp
memory/5060-24-0x0000000000980000-0x00000000009FC000-memory.dmp