Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/05/2026, 02:57
General
- Target 2026-05-07_f8176ac2e3654162dadc3306d314457b_elex_wannacry.exe
- Size 64KB
- Sample260507-dfxvbaet61
- SHA256 b2973dbbd26b95f1ed4538ab24f60e1b0487db24415a8bef8de44187a685d11d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 27 IoCs
- Custom signatureDetects Windows executables referencing non-Windows User-Agents 27 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_f8176ac2e3654162dadc3306d314457b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_f8176ac2e3654162dadc3306d314457b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4940E6B7-0326-4585-88D8-186E23A7896F}.exeC:\Windows\{4940E6B7-0326-4585-88D8-186E23A7896F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDAE63D6-C058-41a7-8A86-A5696C846F66}.exeC:\Windows\{CDAE63D6-C058-41a7-8A86-A5696C846F66}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E544BAE9-8E46-46c2-8065-15E5328FCBD9}.exeC:\Windows\{E544BAE9-8E46-46c2-8065-15E5328FCBD9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{47218FC8-5EC5-4d28-ABB0-0987ECEC941E}.exeC:\Windows\{47218FC8-5EC5-4d28-ABB0-0987ECEC941E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A27599AC-8A88-40e6-81F7-E64BD268AD1B}.exeC:\Windows\{A27599AC-8A88-40e6-81F7-E64BD268AD1B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0589DB7-9BF9-428a-8F52-3F126109E847}.exeC:\Windows\{A0589DB7-9BF9-428a-8F52-3F126109E847}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{004F7BC8-E9B4-4297-99D0-52E6FF85F8CC}.exeC:\Windows\{004F7BC8-E9B4-4297-99D0-52E6FF85F8CC}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{31C3ED6D-E281-4d3b-879A-D616F5616610}.exeC:\Windows\{31C3ED6D-E281-4d3b-879A-D616F5616610}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{42C3A52F-080D-4eec-A42E-149DAE117984}.exeC:\Windows\{42C3A52F-080D-4eec-A42E-149DAE117984}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{31C3E~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{004F7~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A0589~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2759~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{47218~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E544B~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDAE6~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4940E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{004F7BC8-E9B4-4297-99D0-52E6FF85F8CC}.exe
{31C3ED6D-E281-4d3b-879A-D616F5616610}.exe
{42C3A52F-080D-4eec-A42E-149DAE117984}.exe
{47218FC8-5EC5-4d28-ABB0-0987ECEC941E}.exe
{4940E6B7-0326-4585-88D8-186E23A7896F}.exe
{A0589DB7-9BF9-428a-8F52-3F126109E847}.exe
{A27599AC-8A88-40e6-81F7-E64BD268AD1B}.exe
{CDAE63D6-C058-41a7-8A86-A5696C846F66}.exe
{E544BAE9-8E46-46c2-8065-15E5328FCBD9}.exe
memory/736-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/848-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/848-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/848-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3132-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3132-35-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3304-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3428-29-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3428-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3504-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3504-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4144-45-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4272-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4396-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4396-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4708-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4708-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4708-5-0x0000000000400000-0x0000000000410000-memory.dmp