Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
05/05/2026, 15:21
General
- Target 2026-05-05_c9b4231dad58408b91a6753a91f22da3_elex_wannacry.exe
- Size 60KB
- Sample260505-srfshaaz5v
- SHA256 287ee68b06a8a4a861f942351376ea5a0bf39cb1054bfe009c50940a3a488d3c
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-05_c9b4231dad58408b91a6753a91f22da3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-05_c9b4231dad58408b91a6753a91f22da3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{790B4F6C-F158-4a6b-AB60-9E391C730A70}.exeC:\Windows\{790B4F6C-F158-4a6b-AB60-9E391C730A70}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FA8009D1-647E-4282-9F46-CABF2524C1A9}.exeC:\Windows\{FA8009D1-647E-4282-9F46-CABF2524C1A9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{125B02C5-4282-4216-80B2-9F02E6F79486}.exeC:\Windows\{125B02C5-4282-4216-80B2-9F02E6F79486}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1A7510E-A4E6-47fa-A7B3-FEDF23C4C80F}.exeC:\Windows\{F1A7510E-A4E6-47fa-A7B3-FEDF23C4C80F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EFE7F81C-6DC9-46ed-BDB1-6D39AC75A0D0}.exeC:\Windows\{EFE7F81C-6DC9-46ed-BDB1-6D39AC75A0D0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{659E04D9-07AF-4305-B0AC-99394D6CD2BB}.exeC:\Windows\{659E04D9-07AF-4305-B0AC-99394D6CD2BB}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61C7B3C6-45FF-41b1-86EF-DF3B2ECEE1EF}.exeC:\Windows\{61C7B3C6-45FF-41b1-86EF-DF3B2ECEE1EF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8B34735-2311-434a-B3F8-6FF417081A7A}.exeC:\Windows\{E8B34735-2311-434a-B3F8-6FF417081A7A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50D5050C-DAE5-4816-869E-0ECF65BA9B51}.exeC:\Windows\{50D5050C-DAE5-4816-869E-0ECF65BA9B51}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EA617040-065B-43d4-839E-DCD5B969779E}.exeC:\Windows\{EA617040-065B-43d4-839E-DCD5B969779E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{58D4DB0E-145A-4819-9B9F-131461563795}.exeC:\Windows\{58D4DB0E-145A-4819-9B9F-131461563795}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EA617~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50D50~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8B34~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61C7B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{659E0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EFE7F~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1A75~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{125B0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA800~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{790B4~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{125B02C5-4282-4216-80B2-9F02E6F79486}.exe
{50D5050C-DAE5-4816-869E-0ECF65BA9B51}.exe
{58D4DB0E-145A-4819-9B9F-131461563795}.exe
{61C7B3C6-45FF-41b1-86EF-DF3B2ECEE1EF}.exe
{659E04D9-07AF-4305-B0AC-99394D6CD2BB}.exe
{790B4F6C-F158-4a6b-AB60-9E391C730A70}.exe
{E8B34735-2311-434a-B3F8-6FF417081A7A}.exe
{EA617040-065B-43d4-839E-DCD5B969779E}.exe
{EFE7F81C-6DC9-46ed-BDB1-6D39AC75A0D0}.exe
{F1A7510E-A4E6-47fa-A7B3-FEDF23C4C80F}.exe
{FA8009D1-647E-4282-9F46-CABF2524C1A9}.exe
memory/576-40-0x0000000000880000-0x0000000000941000-memory.dmp
memory/576-36-0x0000000000880000-0x0000000000941000-memory.dmp
memory/1528-12-0x00000000009A0000-0x0000000000A61000-memory.dmp
memory/1528-16-0x00000000009A0000-0x0000000000A61000-memory.dmp
memory/2756-10-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/2756-6-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/2804-22-0x0000000000620000-0x00000000006E1000-memory.dmp
memory/2804-18-0x0000000000620000-0x00000000006E1000-memory.dmp
memory/3156-42-0x0000000000970000-0x0000000000A31000-memory.dmp
memory/3156-46-0x0000000000970000-0x0000000000A31000-memory.dmp
memory/3304-28-0x0000000000850000-0x0000000000911000-memory.dmp
memory/3304-24-0x0000000000850000-0x0000000000911000-memory.dmp
memory/3324-60-0x0000000000860000-0x0000000000921000-memory.dmp
memory/3324-64-0x0000000000860000-0x0000000000921000-memory.dmp
memory/3740-34-0x0000000000970000-0x0000000000A31000-memory.dmp
memory/3740-30-0x0000000000970000-0x0000000000A31000-memory.dmp
memory/3876-0-0x0000000000AC0000-0x0000000000B81000-memory.dmp
memory/3876-5-0x0000000000AC0000-0x0000000000B81000-memory.dmp
memory/3968-54-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/3968-58-0x0000000000830000-0x00000000008F1000-memory.dmp
memory/4476-52-0x0000000000880000-0x0000000000941000-memory.dmp
memory/4476-48-0x0000000000880000-0x0000000000941000-memory.dmp