Analysis
- max time kernel
149s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 16:41
General
- Target 2026-05-08_f9d308b6f6c8d5b06b67ba5b5c8686e0_elex_wannacry.exe
- Size 88KB
- Sample260508-t7kbasa12x
- SHA256 1d87f91bc8346379c40ef7fbfe62737929af6b8e7e7e1d560354a5b4026a2aaf
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 37 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-08_f9d308b6f6c8d5b06b67ba5b5c8686e0_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-08_f9d308b6f6c8d5b06b67ba5b5c8686e0_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3C187CEE-F167-4ef2-8A72-38D7AB03FBF6}.exeC:\Windows\{3C187CEE-F167-4ef2-8A72-38D7AB03FBF6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C305ADC-BFA3-4926-BF11-CC447DE2BFD0}.exeC:\Windows\{1C305ADC-BFA3-4926-BF11-CC447DE2BFD0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3AA4D9C2-4E3E-475a-9CFF-05A65D6566CA}.exeC:\Windows\{3AA4D9C2-4E3E-475a-9CFF-05A65D6566CA}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{488C7757-8BEC-4f44-A468-DA2B43003003}.exeC:\Windows\{488C7757-8BEC-4f44-A468-DA2B43003003}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A42A46A-2260-4a8b-890F-4C1F699799F3}.exeC:\Windows\{9A42A46A-2260-4a8b-890F-4C1F699799F3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B098AA81-5F41-4f95-BB60-F758AA4C8B86}.exeC:\Windows\{B098AA81-5F41-4f95-BB60-F758AA4C8B86}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5B91E816-D4DD-4101-9DFE-1E29884DFBB3}.exeC:\Windows\{5B91E816-D4DD-4101-9DFE-1E29884DFBB3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{014D1849-6741-4f2e-80D1-1FC2B15D7A1B}.exeC:\Windows\{014D1849-6741-4f2e-80D1-1FC2B15D7A1B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7EBD100B-3417-4e4c-8FB2-DB595241E821}.exeC:\Windows\{7EBD100B-3417-4e4c-8FB2-DB595241E821}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A09B744A-C9E1-4071-B60F-9F239B85FD7C}.exeC:\Windows\{A09B744A-C9E1-4071-B60F-9F239B85FD7C}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7EBD1~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{014D1~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5B91E~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B098A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9A42A~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{488C7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3AA4D~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C305~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3C187~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{014D1849-6741-4f2e-80D1-1FC2B15D7A1B}.exe
{1C305ADC-BFA3-4926-BF11-CC447DE2BFD0}.exe
{3AA4D9C2-4E3E-475a-9CFF-05A65D6566CA}.exe
{3C187CEE-F167-4ef2-8A72-38D7AB03FBF6}.exe
{488C7757-8BEC-4f44-A468-DA2B43003003}.exe
{5B91E816-D4DD-4101-9DFE-1E29884DFBB3}.exe
{7EBD100B-3417-4e4c-8FB2-DB595241E821}.exe
{9A42A46A-2260-4a8b-890F-4C1F699799F3}.exe
{A09B744A-C9E1-4071-B60F-9F239B85FD7C}.exe
{B098AA81-5F41-4f95-BB60-F758AA4C8B86}.exe
memory/1032-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1032-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1032-19-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/1032-23-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/1032-25-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1108-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1108-1-0x0000000000AC0000-0x0000000000B7F000-memory.dmp
memory/1108-2-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1108-8-0x0000000000AC0000-0x0000000000B7F000-memory.dmp
memory/1108-9-0x0000000000400000-0x0000000000411000-memory.dmp
memory/1972-86-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3012-68-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3012-70-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3012-76-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3012-74-0x0000000000980000-0x0000000000A3F000-memory.dmp
memory/3012-69-0x0000000000980000-0x0000000000A3F000-memory.dmp
memory/3704-28-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/3704-32-0x0000000000840000-0x00000000008FF000-memory.dmp
memory/3704-33-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3704-27-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3760-52-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/3760-51-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3760-55-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/3760-56-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3796-79-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3796-83-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/3796-84-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3796-77-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3796-78-0x0000000000910000-0x00000000009CF000-memory.dmp
memory/3968-6-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3968-10-0x0000000000860000-0x000000000091F000-memory.dmp
memory/3968-15-0x0000000000860000-0x000000000091F000-memory.dmp
memory/3968-16-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3968-11-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4092-66-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4092-65-0x0000000000990000-0x0000000000A4F000-memory.dmp
memory/4092-60-0x0000000000990000-0x0000000000A4F000-memory.dmp
memory/4092-61-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4092-59-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4264-40-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4264-35-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/4264-39-0x0000000000830000-0x00000000008EF000-memory.dmp
memory/4500-42-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4500-44-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4500-43-0x0000000000870000-0x000000000092F000-memory.dmp
memory/4500-49-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4500-48-0x0000000000870000-0x000000000092F000-memory.dmp