Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
- submitted
09/05/2026, 10:24
General
- Target 2026-05-09_7b4bc06d41f1d5e5ae4a9e0c7280bdf2_elex_wannacry.exe
- Size 320KB
- Sample260509-mfczksh18n
- SHA256 257c0511a4719d4747cf5509a108be428c5d770092bcfe66af73990abe40ec1a
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_7b4bc06d41f1d5e5ae4a9e0c7280bdf2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_7b4bc06d41f1d5e5ae4a9e0c7280bdf2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA66A292-D021-4af2-95BD-B5BCD3656FC8}.exeC:\Windows\{BA66A292-D021-4af2-95BD-B5BCD3656FC8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4CB636D7-86D3-48d8-9FF1-6F8D2B7925CD}.exeC:\Windows\{4CB636D7-86D3-48d8-9FF1-6F8D2B7925CD}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2E20830-1C31-4848-93EA-DFF1B59F25B2}.exeC:\Windows\{B2E20830-1C31-4848-93EA-DFF1B59F25B2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC3FD22A-4CBC-4c61-BBD7-2181DCA70798}.exeC:\Windows\{CC3FD22A-4CBC-4c61-BBD7-2181DCA70798}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE918E23-D909-40f4-AFE3-212A75813239}.exeC:\Windows\{EE918E23-D909-40f4-AFE3-212A75813239}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{850A9EC1-0F74-4b95-8D5F-F82CF2526DD7}.exeC:\Windows\{850A9EC1-0F74-4b95-8D5F-F82CF2526DD7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{29ECA22F-230C-46c2-A2EB-19385F63C8D4}.exeC:\Windows\{29ECA22F-230C-46c2-A2EB-19385F63C8D4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F8C02C1-6895-4870-BAA8-5866BF9835C4}.exeC:\Windows\{4F8C02C1-6895-4870-BAA8-5866BF9835C4}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0695855-8FF9-42cd-92BD-19F92FF08F6F}.exeC:\Windows\{F0695855-8FF9-42cd-92BD-19F92FF08F6F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D590134F-1FCE-4f2d-960C-596539A51F3F}.exeC:\Windows\{D590134F-1FCE-4f2d-960C-596539A51F3F}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BA570DF-CB45-489b-ADCD-034BB4F284CD}.exeC:\Windows\{2BA570DF-CB45-489b-ADCD-034BB4F284CD}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D5901~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0695~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F8C0~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{29ECA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{850A9~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE918~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC3FD~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2E20~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4CB63~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA66A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{29ECA22F-230C-46c2-A2EB-19385F63C8D4}.exe
{2BA570DF-CB45-489b-ADCD-034BB4F284CD}.exe
{4CB636D7-86D3-48d8-9FF1-6F8D2B7925CD}.exe
{4F8C02C1-6895-4870-BAA8-5866BF9835C4}.exe
{850A9EC1-0F74-4b95-8D5F-F82CF2526DD7}.exe
{B2E20830-1C31-4848-93EA-DFF1B59F25B2}.exe
{BA66A292-D021-4af2-95BD-B5BCD3656FC8}.exe
{CC3FD22A-4CBC-4c61-BBD7-2181DCA70798}.exe
{D590134F-1FCE-4f2d-960C-596539A51F3F}.exe
{EE918E23-D909-40f4-AFE3-212A75813239}.exe
{F0695855-8FF9-42cd-92BD-19F92FF08F6F}.exe
memory/1776-65-0x0000000000700000-0x0000000000775000-memory.dmp
memory/1776-60-0x0000000000700000-0x0000000000775000-memory.dmp
memory/3880-58-0x0000000000800000-0x0000000000875000-memory.dmp
memory/3880-54-0x0000000000800000-0x0000000000875000-memory.dmp
memory/4624-16-0x0000000000890000-0x0000000000905000-memory.dmp
memory/4624-12-0x0000000000890000-0x0000000000905000-memory.dmp
memory/4720-27-0x00000000005A0000-0x0000000000615000-memory.dmp
memory/4720-24-0x00000000005A0000-0x0000000000615000-memory.dmp
memory/4732-18-0x0000000000910000-0x0000000000985000-memory.dmp
memory/4732-22-0x0000000000910000-0x0000000000985000-memory.dmp
memory/4808-34-0x0000000000790000-0x0000000000805000-memory.dmp
memory/4808-30-0x0000000000790000-0x0000000000805000-memory.dmp
memory/4952-36-0x0000000000900000-0x0000000000975000-memory.dmp
memory/4952-40-0x0000000000900000-0x0000000000975000-memory.dmp
memory/5248-42-0x00000000005A0000-0x0000000000615000-memory.dmp
memory/5248-46-0x00000000005A0000-0x0000000000615000-memory.dmp
memory/5528-0-0x00000000009E0000-0x0000000000A55000-memory.dmp
memory/5528-4-0x00000000009E0000-0x0000000000A55000-memory.dmp
memory/5880-52-0x0000000000890000-0x0000000000905000-memory.dmp
memory/5880-48-0x0000000000890000-0x0000000000905000-memory.dmp
memory/5924-9-0x0000000000930000-0x00000000009A5000-memory.dmp
memory/5924-6-0x0000000000930000-0x00000000009A5000-memory.dmp