Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
09/05/2026, 10:24
General
- Target 2026-05-09_7b4bc06d41f1d5e5ae4a9e0c7280bdf2_elex_wannacry.exe
- Size 320KB
- Sample260509-mfczksh18n
- SHA256 257c0511a4719d4747cf5509a108be428c5d770092bcfe66af73990abe40ec1a
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_7b4bc06d41f1d5e5ae4a9e0c7280bdf2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_7b4bc06d41f1d5e5ae4a9e0c7280bdf2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6D06E702-1396-4caf-835F-0DC4D6D59978}.exeC:\Windows\{6D06E702-1396-4caf-835F-0DC4D6D59978}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FBCFA388-9D83-483f-8416-82364A889604}.exeC:\Windows\{FBCFA388-9D83-483f-8416-82364A889604}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C307F223-6C86-4cf0-854E-5E7ECB94105F}.exeC:\Windows\{C307F223-6C86-4cf0-854E-5E7ECB94105F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B30222E-38F7-4bfd-A394-96E063C8C142}.exeC:\Windows\{9B30222E-38F7-4bfd-A394-96E063C8C142}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{59AC221F-312D-4819-9B49-7E94DAF6A1B1}.exeC:\Windows\{59AC221F-312D-4819-9B49-7E94DAF6A1B1}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{203954C7-6777-40a7-A7BA-B98D8C18B772}.exeC:\Windows\{203954C7-6777-40a7-A7BA-B98D8C18B772}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CDA79FE0-1C5B-4158-8987-2AB608EC388C}.exeC:\Windows\{CDA79FE0-1C5B-4158-8987-2AB608EC388C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{54586A48-C355-4dde-9320-4DA49515FDC2}.exeC:\Windows\{54586A48-C355-4dde-9320-4DA49515FDC2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBC34E1D-3C83-49e0-9AEF-F3698156F521}.exeC:\Windows\{CBC34E1D-3C83-49e0-9AEF-F3698156F521}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{777631EB-7755-4499-A9A0-AF8F685E39D9}.exeC:\Windows\{777631EB-7755-4499-A9A0-AF8F685E39D9}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBC34~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{54586~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CDA79~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20395~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{59AC2~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B302~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C307F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FBCFA~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6D06E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{203954C7-6777-40a7-A7BA-B98D8C18B772}.exe
{54586A48-C355-4dde-9320-4DA49515FDC2}.exe
{59AC221F-312D-4819-9B49-7E94DAF6A1B1}.exe
{6D06E702-1396-4caf-835F-0DC4D6D59978}.exe
{777631EB-7755-4499-A9A0-AF8F685E39D9}.exe
{9B30222E-38F7-4bfd-A394-96E063C8C142}.exe
{C307F223-6C86-4cf0-854E-5E7ECB94105F}.exe
{CBC34E1D-3C83-49e0-9AEF-F3698156F521}.exe
{CDA79FE0-1C5B-4158-8987-2AB608EC388C}.exe
{FBCFA388-9D83-483f-8416-82364A889604}.exe