Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 03:44
General
- Target 2026-05-04_2ae76fe352bc039704f44ab1e499a743_elex_wannacry.exe
- Size 118KB
- Sample260504-eajwyafv9p
- SHA256 31af0361feb9c77bc066bdbade25b2b7dedf6b7ee191c029573141153441a32a
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_2ae76fe352bc039704f44ab1e499a743_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_2ae76fe352bc039704f44ab1e499a743_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CA1DC7B-0B00-473b-9959-92A30A2307C5}.exeC:\Windows\{2CA1DC7B-0B00-473b-9959-92A30A2307C5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DB0607A2-5626-4f9a-ABB0-F465F01F8058}.exeC:\Windows\{DB0607A2-5626-4f9a-ABB0-F465F01F8058}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7D1C4AD9-2C5F-44da-8C57-FBABE7FDCEA6}.exeC:\Windows\{7D1C4AD9-2C5F-44da-8C57-FBABE7FDCEA6}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D65D974D-C594-4d81-897E-B04ADB485388}.exeC:\Windows\{D65D974D-C594-4d81-897E-B04ADB485388}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0022E24C-2CC0-4806-955A-CBC1E033F46C}.exeC:\Windows\{0022E24C-2CC0-4806-955A-CBC1E033F46C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FED0C3E-8666-4788-910D-CC6C99D75BF4}.exeC:\Windows\{2FED0C3E-8666-4788-910D-CC6C99D75BF4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E303EA6D-EB2B-46f6-9F58-B844F9D8E19B}.exeC:\Windows\{E303EA6D-EB2B-46f6-9F58-B844F9D8E19B}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49EDD3F7-24A5-4e97-9205-7FF0829A9E7D}.exeC:\Windows\{49EDD3F7-24A5-4e97-9205-7FF0829A9E7D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0707EF94-CBA3-4128-9182-5976191EF2F4}.exeC:\Windows\{0707EF94-CBA3-4128-9182-5976191EF2F4}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A8045AC-DAC3-453f-ADA6-8157A7EB3E1E}.exeC:\Windows\{3A8045AC-DAC3-453f-ADA6-8157A7EB3E1E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70371DF3-E367-4d7a-A372-D1084DCD4CBA}.exeC:\Windows\{70371DF3-E367-4d7a-A372-D1084DCD4CBA}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A804~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0707E~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49EDD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E303E~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FED0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0022E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D65D9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7D1C4~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DB060~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CA1D~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0022E24C-2CC0-4806-955A-CBC1E033F46C}.exe
{0707EF94-CBA3-4128-9182-5976191EF2F4}.exe
{2CA1DC7B-0B00-473b-9959-92A30A2307C5}.exe
{2FED0C3E-8666-4788-910D-CC6C99D75BF4}.exe
{3A8045AC-DAC3-453f-ADA6-8157A7EB3E1E}.exe
{49EDD3F7-24A5-4e97-9205-7FF0829A9E7D}.exe
{70371DF3-E367-4d7a-A372-D1084DCD4CBA}.exe
{7D1C4AD9-2C5F-44da-8C57-FBABE7FDCEA6}.exe
{D65D974D-C594-4d81-897E-B04ADB485388}.exe
{DB0607A2-5626-4f9a-ABB0-F465F01F8058}.exe
{E303EA6D-EB2B-46f6-9F58-B844F9D8E19B}.exe
memory/1400-42-0x0000000000820000-0x0000000000903000-memory.dmp
memory/1400-47-0x0000000000820000-0x0000000000903000-memory.dmp
memory/2792-60-0x0000000000720000-0x0000000000803000-memory.dmp
memory/2792-64-0x0000000000720000-0x0000000000803000-memory.dmp
memory/4492-10-0x00000000007B0000-0x0000000000893000-memory.dmp
memory/4492-6-0x00000000007B0000-0x0000000000893000-memory.dmp
memory/4660-0-0x00000000009C0000-0x0000000000AA3000-memory.dmp
memory/4660-4-0x00000000009C0000-0x0000000000AA3000-memory.dmp
memory/5032-30-0x0000000000810000-0x00000000008F3000-memory.dmp
memory/5032-33-0x0000000000810000-0x00000000008F3000-memory.dmp
memory/5140-22-0x0000000000750000-0x0000000000833000-memory.dmp
memory/5140-18-0x0000000000750000-0x0000000000833000-memory.dmp
memory/5240-48-0x00000000007F0000-0x00000000008D3000-memory.dmp
memory/5240-52-0x00000000007F0000-0x00000000008D3000-memory.dmp
memory/5412-41-0x0000000000770000-0x0000000000853000-memory.dmp
memory/5412-36-0x0000000000770000-0x0000000000853000-memory.dmp
memory/5456-54-0x0000000000780000-0x0000000000863000-memory.dmp
memory/5456-58-0x0000000000780000-0x0000000000863000-memory.dmp
memory/5520-28-0x0000000000750000-0x0000000000833000-memory.dmp
memory/5520-24-0x0000000000750000-0x0000000000833000-memory.dmp
memory/5760-17-0x0000000000910000-0x00000000009F3000-memory.dmp
memory/5760-12-0x0000000000910000-0x00000000009F3000-memory.dmp