Analysis
- max time kernel
149s - max time network
115s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 03:58
General
- Target 2026-05-04_878fd337e3e9afb2077173e7670202c4_elex_wannacry.exe
- Size 79KB
- Sample260504-ejskfaby8z
- SHA256 637b407961f59825cabeb6f84912c2c64e455ce1b0d7b23251ea3b2c0d88d19d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_878fd337e3e9afb2077173e7670202c4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_878fd337e3e9afb2077173e7670202c4_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CF41623-D81D-499c-8C48-BB4B737B9A8A}.exeC:\Windows\{9CF41623-D81D-499c-8C48-BB4B737B9A8A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01489B3B-AB8F-4eee-B7E2-79629783B0B2}.exeC:\Windows\{01489B3B-AB8F-4eee-B7E2-79629783B0B2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50AB2B32-7213-4e8f-900F-C1FEEE274737}.exeC:\Windows\{50AB2B32-7213-4e8f-900F-C1FEEE274737}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A854550C-E653-4a04-9EA6-18F84B4808E9}.exeC:\Windows\{A854550C-E653-4a04-9EA6-18F84B4808E9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9EF8BB64-489D-4afc-9C0E-D08E34982F91}.exeC:\Windows\{9EF8BB64-489D-4afc-9C0E-D08E34982F91}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DAADDD1F-3C48-4255-BFD6-56EC2BD6AA30}.exeC:\Windows\{DAADDD1F-3C48-4255-BFD6-56EC2BD6AA30}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4EB2ACBD-DC00-4cf1-8EA5-2D9D0DAA687F}.exeC:\Windows\{4EB2ACBD-DC00-4cf1-8EA5-2D9D0DAA687F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6BFCBD33-DFEB-4dea-B9A5-7433F04C7F79}.exeC:\Windows\{6BFCBD33-DFEB-4dea-B9A5-7433F04C7F79}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6EE8214-3124-4040-9192-758598F00AF1}.exeC:\Windows\{D6EE8214-3124-4040-9192-758598F00AF1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{55BB244A-F4B4-4467-8FA8-EB379A40BCC5}.exeC:\Windows\{55BB244A-F4B4-4467-8FA8-EB379A40BCC5}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBA7D62A-115F-43de-A4AB-9808CE0629BC}.exeC:\Windows\{CBA7D62A-115F-43de-A4AB-9808CE0629BC}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{55BB2~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6EE8~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6BFCB~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4EB2A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DAADD~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9EF8B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8545~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50AB2~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01489~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CF41~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{01489B3B-AB8F-4eee-B7E2-79629783B0B2}.exe
{4EB2ACBD-DC00-4cf1-8EA5-2D9D0DAA687F}.exe
{50AB2B32-7213-4e8f-900F-C1FEEE274737}.exe
{55BB244A-F4B4-4467-8FA8-EB379A40BCC5}.exe
{6BFCBD33-DFEB-4dea-B9A5-7433F04C7F79}.exe
{9CF41623-D81D-499c-8C48-BB4B737B9A8A}.exe
{9EF8BB64-489D-4afc-9C0E-D08E34982F91}.exe
{A854550C-E653-4a04-9EA6-18F84B4808E9}.exe
{CBA7D62A-115F-43de-A4AB-9808CE0629BC}.exe
{D6EE8214-3124-4040-9192-758598F00AF1}.exe
{DAADDD1F-3C48-4255-BFD6-56EC2BD6AA30}.exe
memory/920-48-0x0000000000880000-0x000000000093F000-memory.dmp
memory/920-52-0x0000000000880000-0x000000000093F000-memory.dmp
memory/2208-24-0x0000000000850000-0x000000000090F000-memory.dmp
memory/2208-27-0x0000000000850000-0x000000000090F000-memory.dmp
memory/2372-57-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/2372-54-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/2808-5-0x0000000000AD0000-0x0000000000B8F000-memory.dmp
memory/2808-0-0x0000000000AD0000-0x0000000000B8F000-memory.dmp
memory/3144-18-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/3144-22-0x0000000000960000-0x0000000000A1F000-memory.dmp
memory/3328-16-0x0000000000AC0000-0x0000000000B7F000-memory.dmp
memory/3328-12-0x0000000000AC0000-0x0000000000B7F000-memory.dmp
memory/4024-60-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/4024-64-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/4432-46-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4432-42-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4520-40-0x0000000000880000-0x000000000093F000-memory.dmp
memory/4520-36-0x0000000000880000-0x000000000093F000-memory.dmp
memory/5012-34-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/5012-30-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/6068-9-0x0000000000880000-0x000000000093F000-memory.dmp
memory/6068-6-0x0000000000880000-0x000000000093F000-memory.dmp