Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
04/05/2026, 17:15
General
- Target 2026-05-04_4f698fc1e146c716b7f14eec2a751cea_elex_wannacry.exe
- Size 60KB
- Sample260504-vsqefacv6m
- SHA256 a1f948e7afb36cab1f154da3af4d4031a915e21fcd3eb21fbbe6826ae9a0e192
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4f698fc1e146c716b7f14eec2a751cea_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_4f698fc1e146c716b7f14eec2a751cea_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93AC78B1-C3B0-4e7e-885B-3171349910FA}.exeC:\Windows\{93AC78B1-C3B0-4e7e-885B-3171349910FA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB2DEB7C-5180-4ee1-A3A0-427857C06313}.exeC:\Windows\{EB2DEB7C-5180-4ee1-A3A0-427857C06313}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{128B67D5-ED11-42a4-99EE-3AEA84B40520}.exeC:\Windows\{128B67D5-ED11-42a4-99EE-3AEA84B40520}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9FA3ED5C-0746-42cc-9104-30500BCAC831}.exeC:\Windows\{9FA3ED5C-0746-42cc-9104-30500BCAC831}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{707A07EE-5F4D-4ba3-B657-9AF0395DADB3}.exeC:\Windows\{707A07EE-5F4D-4ba3-B657-9AF0395DADB3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C367BAF-BFE7-4456-8EB0-DC57B610AA5D}.exeC:\Windows\{1C367BAF-BFE7-4456-8EB0-DC57B610AA5D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A003B9B2-B280-4787-8184-F22DFFAC32D5}.exeC:\Windows\{A003B9B2-B280-4787-8184-F22DFFAC32D5}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17BAB389-168D-4513-BF23-E082ED4050F5}.exeC:\Windows\{17BAB389-168D-4513-BF23-E082ED4050F5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{672FF00C-A19D-46fc-808E-5C26F2072F9A}.exeC:\Windows\{672FF00C-A19D-46fc-808E-5C26F2072F9A}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B7A8B76B-B451-44cc-B8CE-B25D65DE1624}.exeC:\Windows\{B7A8B76B-B451-44cc-B8CE-B25D65DE1624}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{672FF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17BAB~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A003B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C367~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{707A0~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9FA3E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{128B6~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB2DE~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93AC7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{128B67D5-ED11-42a4-99EE-3AEA84B40520}.exe
{17BAB389-168D-4513-BF23-E082ED4050F5}.exe
{1C367BAF-BFE7-4456-8EB0-DC57B610AA5D}.exe
{672FF00C-A19D-46fc-808E-5C26F2072F9A}.exe
{707A07EE-5F4D-4ba3-B657-9AF0395DADB3}.exe
{93AC78B1-C3B0-4e7e-885B-3171349910FA}.exe
{9FA3ED5C-0746-42cc-9104-30500BCAC831}.exe
{A003B9B2-B280-4787-8184-F22DFFAC32D5}.exe
{B7A8B76B-B451-44cc-B8CE-B25D65DE1624}.exe
{EB2DEB7C-5180-4ee1-A3A0-427857C06313}.exe