Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 03:46
General
- Target 2026-05-11_18bc461bbb47f996ea7bfa247c6fd90b_elex_wannacry.exe
- Size 60KB
- Sample260511-ebtgrses7q
- SHA256 91d468ef8cc8bc252a8986f2cd49eb33fd6963aaca0426a89a730a09166bfdb6
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_18bc461bbb47f996ea7bfa247c6fd90b_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_18bc461bbb47f996ea7bfa247c6fd90b_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{251CCAE3-8576-4b1d-BD05-129FEA6F0A24}.exeC:\Windows\{251CCAE3-8576-4b1d-BD05-129FEA6F0A24}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{211F6ADC-7117-4c67-964A-EF00ABF01819}.exeC:\Windows\{211F6ADC-7117-4c67-964A-EF00ABF01819}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0CDE0C88-4090-4eac-9947-D14E1C3C603B}.exeC:\Windows\{0CDE0C88-4090-4eac-9947-D14E1C3C603B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4A66B65A-5207-43d3-86D7-6E97798B756D}.exeC:\Windows\{4A66B65A-5207-43d3-86D7-6E97798B756D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE8AD378-288B-4ce9-902A-561A582F417A}.exeC:\Windows\{DE8AD378-288B-4ce9-902A-561A582F417A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF27E688-C246-4fed-872B-2C0E98F8DFAD}.exeC:\Windows\{AF27E688-C246-4fed-872B-2C0E98F8DFAD}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F37E8389-7D05-46ce-AEE4-A4063C9CEC5C}.exeC:\Windows\{F37E8389-7D05-46ce-AEE4-A4063C9CEC5C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{112D45DF-B8EC-440a-ABB3-1F81FF4407B8}.exeC:\Windows\{112D45DF-B8EC-440a-ABB3-1F81FF4407B8}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F01E846C-429F-4bbf-BBE7-0221297E3D86}.exeC:\Windows\{F01E846C-429F-4bbf-BBE7-0221297E3D86}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0EBB9FA-81A0-401e-B803-A23CD055B7BC}.exeC:\Windows\{B0EBB9FA-81A0-401e-B803-A23CD055B7BC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1009B1D8-A7EA-4167-B73A-8D753B0EB21B}.exeC:\Windows\{1009B1D8-A7EA-4167-B73A-8D753B0EB21B}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0EBB~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F01E8~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{112D4~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F37E8~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF27E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE8AD~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4A66B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0CDE0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{211F6~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{251CC~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0CDE0C88-4090-4eac-9947-D14E1C3C603B}.exe
{1009B1D8-A7EA-4167-B73A-8D753B0EB21B}.exe
{112D45DF-B8EC-440a-ABB3-1F81FF4407B8}.exe
{211F6ADC-7117-4c67-964A-EF00ABF01819}.exe
{251CCAE3-8576-4b1d-BD05-129FEA6F0A24}.exe
{4A66B65A-5207-43d3-86D7-6E97798B756D}.exe
{AF27E688-C246-4fed-872B-2C0E98F8DFAD}.exe
{B0EBB9FA-81A0-401e-B803-A23CD055B7BC}.exe
{DE8AD378-288B-4ce9-902A-561A582F417A}.exe
{F01E846C-429F-4bbf-BBE7-0221297E3D86}.exe
{F37E8389-7D05-46ce-AEE4-A4063C9CEC5C}.exe
memory/220-42-0x0000000000780000-0x000000000083F000-memory.dmp
memory/220-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/220-47-0x0000000000400000-0x0000000000410000-memory.dmp
memory/220-46-0x0000000000780000-0x000000000083F000-memory.dmp
memory/1988-53-0x00000000005A0000-0x000000000065F000-memory.dmp
memory/1988-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1988-49-0x00000000005A0000-0x000000000065F000-memory.dmp
memory/2320-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2320-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2320-15-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/2320-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2320-10-0x00000000008A0000-0x000000000095F000-memory.dmp
memory/2508-34-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/2508-38-0x0000000000820000-0x00000000008DF000-memory.dmp
memory/2508-40-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2672-68-0x0000000000770000-0x000000000082F000-memory.dmp
memory/2672-69-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2672-64-0x0000000000770000-0x000000000082F000-memory.dmp
memory/2888-84-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3284-57-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/3284-60-0x00000000008F0000-0x00000000009AF000-memory.dmp
memory/3284-61-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3284-56-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4128-72-0x0000000000890000-0x000000000094F000-memory.dmp
memory/4128-77-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4128-71-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4128-76-0x0000000000890000-0x000000000094F000-memory.dmp
memory/4148-9-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4148-8-0x00000000005E0000-0x000000000069F000-memory.dmp
memory/4148-2-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4148-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4148-1-0x00000000005E0000-0x000000000069F000-memory.dmp
memory/4216-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4216-24-0x00000000007D0000-0x000000000088F000-memory.dmp
memory/4216-25-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4216-19-0x00000000007D0000-0x000000000088F000-memory.dmp
memory/4416-27-0x00000000007C0000-0x000000000087F000-memory.dmp
memory/4416-31-0x00000000007C0000-0x000000000087F000-memory.dmp
memory/4416-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4416-26-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4800-79-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4800-80-0x0000000000860000-0x000000000091F000-memory.dmp
memory/4800-85-0x0000000000860000-0x000000000091F000-memory.dmp
memory/4800-87-0x0000000000400000-0x0000000000410000-memory.dmp