Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 15:27
General
- Target 2026-05-03_7e6539af70f289610e3232566b9b1839_elex_wannacry.exe
- Size 64KB
- Sample260503-sv7qdsct2x
- SHA256 9ed4712937029c3bd7b3d4909480afd38dbd116f2aa09fd2d50420c0ca833f86
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 37 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_7e6539af70f289610e3232566b9b1839_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_7e6539af70f289610e3232566b9b1839_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51EA43E1-73BA-4d05-AB7C-F030BA38F35D}.exeC:\Windows\{51EA43E1-73BA-4d05-AB7C-F030BA38F35D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3D1E288-4ED4-4ba8-8EE4-4E799076859B}.exeC:\Windows\{A3D1E288-4ED4-4ba8-8EE4-4E799076859B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5AEDFFDC-82F6-479b-98E3-C391E9DF149A}.exeC:\Windows\{5AEDFFDC-82F6-479b-98E3-C391E9DF149A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB630F72-984E-47b9-B514-EA7F864024F1}.exeC:\Windows\{FB630F72-984E-47b9-B514-EA7F864024F1}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9ADF14D7-1B18-4fd7-8943-1D1833ABA64B}.exeC:\Windows\{9ADF14D7-1B18-4fd7-8943-1D1833ABA64B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{758F0465-38E6-4b7f-9923-434A71CE9AC7}.exeC:\Windows\{758F0465-38E6-4b7f-9923-434A71CE9AC7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA0216D7-35F0-498b-B0A7-FFCC8C7BD13A}.exeC:\Windows\{FA0216D7-35F0-498b-B0A7-FFCC8C7BD13A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B929F8E1-AF69-48da-B5E9-BD9BF35F024F}.exeC:\Windows\{B929F8E1-AF69-48da-B5E9-BD9BF35F024F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EFB1BA01-383A-40b6-8813-9F11AB6244CF}.exeC:\Windows\{EFB1BA01-383A-40b6-8813-9F11AB6244CF}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{090A53E6-1C9F-440a-9111-150AB046068B}.exeC:\Windows\{090A53E6-1C9F-440a-9111-150AB046068B}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFB1B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B929F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA021~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{758F0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9ADF1~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB630~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5AEDF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3D1E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51EA4~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{090A53E6-1C9F-440a-9111-150AB046068B}.exe
{51EA43E1-73BA-4d05-AB7C-F030BA38F35D}.exe
{5AEDFFDC-82F6-479b-98E3-C391E9DF149A}.exe
{758F0465-38E6-4b7f-9923-434A71CE9AC7}.exe
{9ADF14D7-1B18-4fd7-8943-1D1833ABA64B}.exe
{A3D1E288-4ED4-4ba8-8EE4-4E799076859B}.exe
{B929F8E1-AF69-48da-B5E9-BD9BF35F024F}.exe
{EFB1BA01-383A-40b6-8813-9F11AB6244CF}.exe
{FA0216D7-35F0-498b-B0A7-FFCC8C7BD13A}.exe
{FB630F72-984E-47b9-B514-EA7F864024F1}.exe
memory/804-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/804-48-0x0000000000880000-0x0000000000942000-memory.dmp
memory/804-44-0x0000000000880000-0x0000000000942000-memory.dmp
memory/804-43-0x0000000000400000-0x0000000000410000-memory.dmp
memory/896-86-0x0000000000400000-0x0000000000410000-memory.dmp
memory/896-87-0x0000000000880000-0x0000000000942000-memory.dmp
memory/2144-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2144-31-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/2144-27-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/2248-20-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2248-19-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/2248-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2248-23-0x0000000000820000-0x00000000008E2000-memory.dmp
memory/2248-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3040-66-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3040-60-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3040-65-0x0000000000840000-0x0000000000902000-memory.dmp
memory/3040-61-0x0000000000840000-0x0000000000902000-memory.dmp
memory/3284-83-0x0000000000980000-0x0000000000A42000-memory.dmp
memory/3284-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3284-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3284-84-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3284-78-0x0000000000980000-0x0000000000A42000-memory.dmp
memory/3572-35-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/3572-40-0x0000000000990000-0x0000000000A52000-memory.dmp
memory/3572-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3572-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3572-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3980-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3980-15-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/3980-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3980-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3980-10-0x0000000000960000-0x0000000000A22000-memory.dmp
memory/4200-75-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4200-68-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4200-70-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4200-69-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/4200-74-0x0000000000970000-0x0000000000A32000-memory.dmp
memory/4968-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4968-7-0x00000000009B0000-0x0000000000A72000-memory.dmp
memory/4968-1-0x00000000009B0000-0x0000000000A72000-memory.dmp
memory/4968-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4968-2-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5096-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5096-59-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5096-52-0x0000000000830000-0x00000000008F2000-memory.dmp
memory/5096-50-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5096-58-0x0000000000830000-0x00000000008F2000-memory.dmp