Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 03:44
General
- Target 2026-05-04_6981f50dedab773c5f05a1a2000d1377_elex_wannacry.exe
- Size 66KB
- Sample260504-eayebsbx9w
- SHA256 e3c75a9805dc632bfba0d2cf1d07abc321b053af2ddd37f2cef56b192c39079e
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 22 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_6981f50dedab773c5f05a1a2000d1377_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_6981f50dedab773c5f05a1a2000d1377_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8F5FEBC-E84B-4e02-921C-7CA37BDE4840}.exeC:\Windows\{E8F5FEBC-E84B-4e02-921C-7CA37BDE4840}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91AD8260-C7CF-4b21-91B5-0EE4543034B9}.exeC:\Windows\{91AD8260-C7CF-4b21-91B5-0EE4543034B9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30C286BF-DFC3-4486-B2D4-07A8516F6862}.exeC:\Windows\{30C286BF-DFC3-4486-B2D4-07A8516F6862}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9105AE74-CBEE-4581-8395-5B9179AF1916}.exeC:\Windows\{9105AE74-CBEE-4581-8395-5B9179AF1916}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38315401-1E6A-4ece-9AC2-807D571A073A}.exeC:\Windows\{38315401-1E6A-4ece-9AC2-807D571A073A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3BB6097-4D2F-4fd0-AC57-C82B275FA7A0}.exeC:\Windows\{B3BB6097-4D2F-4fd0-AC57-C82B275FA7A0}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D89EB1E2-9F8C-4181-84F2-F63231BB378D}.exeC:\Windows\{D89EB1E2-9F8C-4181-84F2-F63231BB378D}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A20D4A18-FEAA-4ef8-B442-8551B98DC8FC}.exeC:\Windows\{A20D4A18-FEAA-4ef8-B442-8551B98DC8FC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16555497-1B21-4764-ACFC-E4DDE3F2B21E}.exeC:\Windows\{16555497-1B21-4764-ACFC-E4DDE3F2B21E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76095F18-4CE1-4c0d-A279-000A1F1284F3}.exeC:\Windows\{76095F18-4CE1-4c0d-A279-000A1F1284F3}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16555~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A20D4~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D89EB~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3BB6~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38315~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9105A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30C28~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91AD8~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8F5F~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{16555497-1B21-4764-ACFC-E4DDE3F2B21E}.exe
{30C286BF-DFC3-4486-B2D4-07A8516F6862}.exe
{38315401-1E6A-4ece-9AC2-807D571A073A}.exe
{76095F18-4CE1-4c0d-A279-000A1F1284F3}.exe
{9105AE74-CBEE-4581-8395-5B9179AF1916}.exe
{91AD8260-C7CF-4b21-91B5-0EE4543034B9}.exe
{A20D4A18-FEAA-4ef8-B442-8551B98DC8FC}.exe
{B3BB6097-4D2F-4fd0-AC57-C82B275FA7A0}.exe
{D89EB1E2-9F8C-4181-84F2-F63231BB378D}.exe
{E8F5FEBC-E84B-4e02-921C-7CA37BDE4840}.exe
memory/8-45-0x0000000000400000-0x0000000000411000-memory.dmp
memory/8-41-0x0000000002110000-0x0000000002174000-memory.dmp
memory/8-46-0x0000000002110000-0x0000000002174000-memory.dmp
memory/396-22-0x0000000003CE0000-0x0000000003D44000-memory.dmp
memory/396-21-0x0000000000400000-0x0000000000411000-memory.dmp
memory/396-17-0x0000000003CE0000-0x0000000003D44000-memory.dmp
memory/2168-65-0x0000000003CF0000-0x0000000003D54000-memory.dmp
memory/2168-70-0x0000000003CF0000-0x0000000003D54000-memory.dmp
memory/2168-69-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2760-14-0x0000000003C00000-0x0000000003C64000-memory.dmp
memory/2760-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2760-9-0x0000000003C00000-0x0000000003C64000-memory.dmp
memory/2760-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3056-49-0x0000000002120000-0x0000000002184000-memory.dmp
memory/3056-55-0x0000000002120000-0x0000000002184000-memory.dmp
memory/3056-53-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3364-38-0x0000000003BB0000-0x0000000003C14000-memory.dmp
memory/3364-37-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3364-33-0x0000000003BB0000-0x0000000003C14000-memory.dmp
memory/3740-78-0x0000000003CA0000-0x0000000003D04000-memory.dmp
memory/3740-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3740-73-0x0000000003CA0000-0x0000000003D04000-memory.dmp
memory/4044-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4044-63-0x0000000002220000-0x0000000002284000-memory.dmp
memory/4044-57-0x0000000002220000-0x0000000002284000-memory.dmp
memory/5020-7-0x0000000003BD0000-0x0000000003C34000-memory.dmp
memory/5020-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5020-1-0x0000000003BD0000-0x0000000003C34000-memory.dmp
memory/5020-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5056-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5056-30-0x0000000003D70000-0x0000000003DD4000-memory.dmp
memory/5056-25-0x0000000003D70000-0x0000000003DD4000-memory.dmp