Analysis
- max time kernel
149s - max time network
108s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 14:48
General
- Target 2026-05-04_f11540981118423360ab6452a6c11ab4_elex_wannacry.exe
- Size 60KB
- Sample260504-r6xtwsd16w
- SHA256 dbd58263cc7414b0f33d56a193a27baecac6ede2137407e092b805f9f81fe9fc
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Detects Windows executables referencing non-Windows User-Agents 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_f11540981118423360ab6452a6c11ab4_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_f11540981118423360ab6452a6c11ab4_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10882980-14D8-40e9-A0C3-C4953B237298}.exeC:\Windows\{10882980-14D8-40e9-A0C3-C4953B237298}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7BDCDFC0-70B6-48f9-BA0B-BC34C0552FE5}.exeC:\Windows\{7BDCDFC0-70B6-48f9-BA0B-BC34C0552FE5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1348E718-7EF1-47ea-A560-5DA86BE2D96A}.exeC:\Windows\{1348E718-7EF1-47ea-A560-5DA86BE2D96A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{23A2B24B-6D89-4922-8048-DDAEB3AD0595}.exeC:\Windows\{23A2B24B-6D89-4922-8048-DDAEB3AD0595}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A50FDD6-74BF-4fa2-87A9-4F5474CB05B2}.exeC:\Windows\{3A50FDD6-74BF-4fa2-87A9-4F5474CB05B2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA0AD2AD-555E-4e46-B349-CC12E93AEBBB}.exeC:\Windows\{BA0AD2AD-555E-4e46-B349-CC12E93AEBBB}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0B82166-F4EF-49be-B4D9-A5B7F9154E46}.exeC:\Windows\{D0B82166-F4EF-49be-B4D9-A5B7F9154E46}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{543A1710-DCF8-4eac-9B46-DEA27EECB3BC}.exeC:\Windows\{543A1710-DCF8-4eac-9B46-DEA27EECB3BC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE5DE8CD-B5EE-4349-B14D-BC35AA45C969}.exeC:\Windows\{EE5DE8CD-B5EE-4349-B14D-BC35AA45C969}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD9C5E34-A8DA-4240-889C-1F2BB37F1812}.exeC:\Windows\{DD9C5E34-A8DA-4240-889C-1F2BB37F1812}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE5DE~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{543A1~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0B82~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA0AD~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A50F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23A2B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1348E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7BDCD~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10882~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{10882980-14D8-40e9-A0C3-C4953B237298}.exe
{1348E718-7EF1-47ea-A560-5DA86BE2D96A}.exe
{23A2B24B-6D89-4922-8048-DDAEB3AD0595}.exe
{3A50FDD6-74BF-4fa2-87A9-4F5474CB05B2}.exe
{543A1710-DCF8-4eac-9B46-DEA27EECB3BC}.exe
{7BDCDFC0-70B6-48f9-BA0B-BC34C0552FE5}.exe
{BA0AD2AD-555E-4e46-B349-CC12E93AEBBB}.exe
{D0B82166-F4EF-49be-B4D9-A5B7F9154E46}.exe
{DD9C5E34-A8DA-4240-889C-1F2BB37F1812}.exe
{EE5DE8CD-B5EE-4349-B14D-BC35AA45C969}.exe