Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 15:08
General
- Target 2026-05-04_bf8a371569cf21cf508757eefac87d77_elex_wannacry.exe
- Size 60KB
- Sample260504-sh684aev2z
- SHA256 fc05a99c45e3058cd2157334879eb3c5ba4e412501d2946beb7148a57cec4460
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_bf8a371569cf21cf508757eefac87d77_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_bf8a371569cf21cf508757eefac87d77_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{153ADAFB-3DDF-4b75-A3BA-33622DF03B35}.exeC:\Windows\{153ADAFB-3DDF-4b75-A3BA-33622DF03B35}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D298A793-446F-4fcb-9ED6-C3A9AC0256B9}.exeC:\Windows\{D298A793-446F-4fcb-9ED6-C3A9AC0256B9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2FB03114-BEDB-4cf6-9FB7-ACEECBD5F8A8}.exeC:\Windows\{2FB03114-BEDB-4cf6-9FB7-ACEECBD5F8A8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44545751-737D-4127-9546-0935370D2F71}.exeC:\Windows\{44545751-737D-4127-9546-0935370D2F71}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E99D45B3-D8A9-42dd-A146-3E63721629A4}.exeC:\Windows\{E99D45B3-D8A9-42dd-A146-3E63721629A4}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52CB7D3E-5ECC-4201-9617-BA6BCE500078}.exeC:\Windows\{52CB7D3E-5ECC-4201-9617-BA6BCE500078}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{273057B7-3DBF-4a9b-B808-6CB349A7EFCB}.exeC:\Windows\{273057B7-3DBF-4a9b-B808-6CB349A7EFCB}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FEF8C81E-C114-44eb-BBD1-CA853A0C3C20}.exeC:\Windows\{FEF8C81E-C114-44eb-BBD1-CA853A0C3C20}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4EC7AF01-E85E-45ba-8860-FB8E51F6D0D3}.exeC:\Windows\{4EC7AF01-E85E-45ba-8860-FB8E51F6D0D3}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD9BCBB2-A73C-4d59-B2E6-F7FF337752FE}.exeC:\Windows\{BD9BCBB2-A73C-4d59-B2E6-F7FF337752FE}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4EC7A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FEF8C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27305~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52CB7~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E99D4~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44545~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2FB03~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D298A~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{153AD~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{153ADAFB-3DDF-4b75-A3BA-33622DF03B35}.exe
{273057B7-3DBF-4a9b-B808-6CB349A7EFCB}.exe
{2FB03114-BEDB-4cf6-9FB7-ACEECBD5F8A8}.exe
{44545751-737D-4127-9546-0935370D2F71}.exe
{4EC7AF01-E85E-45ba-8860-FB8E51F6D0D3}.exe
{52CB7D3E-5ECC-4201-9617-BA6BCE500078}.exe
{BD9BCBB2-A73C-4d59-B2E6-F7FF337752FE}.exe
{D298A793-446F-4fcb-9ED6-C3A9AC0256B9}.exe
{E99D45B3-D8A9-42dd-A146-3E63721629A4}.exe
{FEF8C81E-C114-44eb-BBD1-CA853A0C3C20}.exe
memory/1824-58-0x00000000021C0000-0x000000000229A000-memory.dmp
memory/1824-55-0x00000000021C0000-0x000000000229A000-memory.dmp
memory/2640-11-0x0000000002290000-0x000000000236A000-memory.dmp
memory/2640-7-0x0000000002290000-0x000000000236A000-memory.dmp
memory/3284-13-0x00000000021D0000-0x00000000022AA000-memory.dmp
memory/3284-16-0x00000000021D0000-0x00000000022AA000-memory.dmp
memory/4124-43-0x0000000003BF0000-0x0000000003CCA000-memory.dmp
memory/4124-47-0x0000000003BF0000-0x0000000003CCA000-memory.dmp
memory/4396-29-0x0000000003BF0000-0x0000000003CCA000-memory.dmp
memory/4396-25-0x0000000003BF0000-0x0000000003CCA000-memory.dmp
memory/4728-31-0x0000000003BF0000-0x0000000003CCA000-memory.dmp
memory/4728-34-0x0000000003BF0000-0x0000000003CCA000-memory.dmp
memory/5220-53-0x0000000003C10000-0x0000000003CEA000-memory.dmp
memory/5220-49-0x0000000003C10000-0x0000000003CEA000-memory.dmp
memory/5260-0-0x0000000003C50000-0x0000000003D2A000-memory.dmp
memory/5260-6-0x0000000003C50000-0x0000000003D2A000-memory.dmp
memory/5260-1-0x0000000003C50000-0x0000000003D2A000-memory.dmp
memory/5280-23-0x0000000003BD0000-0x0000000003CAA000-memory.dmp
memory/5280-19-0x0000000003BD0000-0x0000000003CAA000-memory.dmp
memory/5332-41-0x00000000020D0000-0x00000000021AA000-memory.dmp
memory/5332-37-0x00000000020D0000-0x00000000021AA000-memory.dmp