Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 07:51
General
- Target 2026-05-06_7eefcb94392634f875b289333b615855_elex_wannacry.exe
- Size 96KB
- Sample260506-jptrxag13j
- SHA256 6e18dae1e38880ed90c0e7b22c1f9b6b936fac90f498bc4f967113f2d77da30b
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 9 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_7eefcb94392634f875b289333b615855_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_7eefcb94392634f875b289333b615855_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3806592-FF57-4cc8-B52B-AB0310A3A2F6}.exeC:\Windows\{A3806592-FF57-4cc8-B52B-AB0310A3A2F6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C54254A4-6919-48f6-95F3-FA357B79C6EC}.exeC:\Windows\{C54254A4-6919-48f6-95F3-FA357B79C6EC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1303B975-08D9-4354-9AAA-D2E8EA03645A}.exeC:\Windows\{1303B975-08D9-4354-9AAA-D2E8EA03645A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{399D3183-256A-408b-B102-2ACFE3664B8D}.exeC:\Windows\{399D3183-256A-408b-B102-2ACFE3664B8D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{71B7343B-25E1-49b9-9FBD-9E611C78FA01}.exeC:\Windows\{71B7343B-25E1-49b9-9FBD-9E611C78FA01}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B548477-0BCF-4066-84AC-52BC1C7ED120}.exeC:\Windows\{1B548477-0BCF-4066-84AC-52BC1C7ED120}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64F62628-9D8A-4b2e-A187-57817DBF8798}.exeC:\Windows\{64F62628-9D8A-4b2e-A187-57817DBF8798}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2E48E01-3FAF-47cf-AE69-9AC80DF635C5}.exeC:\Windows\{B2E48E01-3FAF-47cf-AE69-9AC80DF635C5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1309EBA3-D65A-4e83-9878-DFB36B02375A}.exeC:\Windows\{1309EBA3-D65A-4e83-9878-DFB36B02375A}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2E48~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64F62~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B548~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71B73~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{399D3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1303B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C5425~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A3806~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1303B975-08D9-4354-9AAA-D2E8EA03645A}.exe
{1309EBA3-D65A-4e83-9878-DFB36B02375A}.exe
{1B548477-0BCF-4066-84AC-52BC1C7ED120}.exe
{399D3183-256A-408b-B102-2ACFE3664B8D}.exe
{64F62628-9D8A-4b2e-A187-57817DBF8798}.exe
{71B7343B-25E1-49b9-9FBD-9E611C78FA01}.exe
{A3806592-FF57-4cc8-B52B-AB0310A3A2F6}.exe
{B2E48E01-3FAF-47cf-AE69-9AC80DF635C5}.exe
{C54254A4-6919-48f6-95F3-FA357B79C6EC}.exe
memory/1596-36-0x0000000000970000-0x0000000000A0C000-memory.dmp
memory/1596-40-0x0000000000970000-0x0000000000A0C000-memory.dmp
memory/2588-42-0x0000000000820000-0x00000000008BC000-memory.dmp
memory/2588-47-0x0000000000820000-0x00000000008BC000-memory.dmp
memory/2892-48-0x0000000000840000-0x00000000008DC000-memory.dmp
memory/2892-52-0x0000000000840000-0x00000000008DC000-memory.dmp
memory/3152-10-0x00000000009B0000-0x0000000000A4C000-memory.dmp
memory/3152-6-0x00000000009B0000-0x0000000000A4C000-memory.dmp
memory/4036-12-0x0000000000820000-0x00000000008BC000-memory.dmp
memory/4036-16-0x0000000000820000-0x00000000008BC000-memory.dmp
memory/4648-0-0x0000000000AB0000-0x0000000000B4C000-memory.dmp
memory/4648-4-0x0000000000AB0000-0x0000000000B4C000-memory.dmp
memory/4760-34-0x0000000000970000-0x0000000000A0C000-memory.dmp
memory/4760-30-0x0000000000970000-0x0000000000A0C000-memory.dmp
memory/5020-22-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/5020-18-0x0000000000850000-0x00000000008EC000-memory.dmp
memory/5100-28-0x0000000000840000-0x00000000008DC000-memory.dmp
memory/5100-24-0x0000000000840000-0x00000000008DC000-memory.dmp