Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 16:30
General
- Target 2026-05-06_6ba892b409f246ed0eaacc2080f79866_elex_wannacry.exe
- Size 59KB
- Sample260506-tz2wdaev41
- SHA256 af7ed9dad8678aec3e56b0c197ab137b8a5def321c8ae70afa0b2c021d35e7e3
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Detects Windows executables referencing non-Windows User-Agents 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_6ba892b409f246ed0eaacc2080f79866_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_6ba892b409f246ed0eaacc2080f79866_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6B2640C-DA98-473b-92EC-986F15D2B921}.exeC:\Windows\{F6B2640C-DA98-473b-92EC-986F15D2B921}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81BF0876-FEF0-4e6e-9D87-806108D12A58}.exeC:\Windows\{81BF0876-FEF0-4e6e-9D87-806108D12A58}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{00E26300-75BB-4bc5-BFA4-FA1AA41EBD1A}.exeC:\Windows\{00E26300-75BB-4bc5-BFA4-FA1AA41EBD1A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9609D154-1D4E-47b3-AC8A-9139D9121C0F}.exeC:\Windows\{9609D154-1D4E-47b3-AC8A-9139D9121C0F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B6DDEF5-53C7-4555-AB89-9F6F179AD982}.exeC:\Windows\{6B6DDEF5-53C7-4555-AB89-9F6F179AD982}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AD3D2E1D-A46D-465a-B5B8-91FE25D32905}.exeC:\Windows\{AD3D2E1D-A46D-465a-B5B8-91FE25D32905}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{176528A1-F47F-4658-8EC3-854419149633}.exeC:\Windows\{176528A1-F47F-4658-8EC3-854419149633}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{47570034-8F23-41ff-AAE6-1B113E33E667}.exeC:\Windows\{47570034-8F23-41ff-AAE6-1B113E33E667}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B732717C-15BE-43e5-9EF5-93E5242A63C9}.exeC:\Windows\{B732717C-15BE-43e5-9EF5-93E5242A63C9}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80F86ECD-7FCC-46f8-8C89-7D431436C807}.exeC:\Windows\{80F86ECD-7FCC-46f8-8C89-7D431436C807}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82084509-1949-4292-B3D0-E652BD26BD7D}.exeC:\Windows\{82084509-1949-4292-B3D0-E652BD26BD7D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80F86~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7327~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47570~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17652~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AD3D2~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B6DD~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9609D~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{00E26~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81BF0~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6B26~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{00E26300-75BB-4bc5-BFA4-FA1AA41EBD1A}.exe
{176528A1-F47F-4658-8EC3-854419149633}.exe
{47570034-8F23-41ff-AAE6-1B113E33E667}.exe
{6B6DDEF5-53C7-4555-AB89-9F6F179AD982}.exe
{80F86ECD-7FCC-46f8-8C89-7D431436C807}.exe
{81BF0876-FEF0-4e6e-9D87-806108D12A58}.exe
{82084509-1949-4292-B3D0-E652BD26BD7D}.exe
{9609D154-1D4E-47b3-AC8A-9139D9121C0F}.exe
{AD3D2E1D-A46D-465a-B5B8-91FE25D32905}.exe
{B732717C-15BE-43e5-9EF5-93E5242A63C9}.exe
{F6B2640C-DA98-473b-92EC-986F15D2B921}.exe