Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 10:44
General
- Target 2026-05-11_91dc9e76696c81fb0ead0d5327592aa2_elex_wannacry.exe
- Size 372KB
- Sample260511-ms2hpsaz6j
- SHA256 69863af731c17413ff0ddf38a1dc4ea340600370b97ba235d82d3d992c50e56a
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_91dc9e76696c81fb0ead0d5327592aa2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_91dc9e76696c81fb0ead0d5327592aa2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{285F8352-50D6-4915-BBBD-D816F6017E7E}.exeC:\Windows\{285F8352-50D6-4915-BBBD-D816F6017E7E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D6C3B81-B000-4977-B602-5B9C4A2D7E20}.exeC:\Windows\{1D6C3B81-B000-4977-B602-5B9C4A2D7E20}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{675350D5-DF22-4beb-B709-2C536FFE1CDF}.exeC:\Windows\{675350D5-DF22-4beb-B709-2C536FFE1CDF}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F6959BB-295B-4b56-8ACF-32B94FDB49AA}.exeC:\Windows\{1F6959BB-295B-4b56-8ACF-32B94FDB49AA}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8092287A-B7E8-4869-A023-45CCD06F1969}.exeC:\Windows\{8092287A-B7E8-4869-A023-45CCD06F1969}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{563FED39-31BC-4d8f-B9F5-859A676B7B8D}.exeC:\Windows\{563FED39-31BC-4d8f-B9F5-859A676B7B8D}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{585DA254-63F2-4db3-87C7-3995855BFD33}.exeC:\Windows\{585DA254-63F2-4db3-87C7-3995855BFD33}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{852CDB2F-69B3-441b-AC4E-2BF4B4E57DF5}.exeC:\Windows\{852CDB2F-69B3-441b-AC4E-2BF4B4E57DF5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CF1317C-2B69-46c2-A924-DA07563E4777}.exeC:\Windows\{5CF1317C-2B69-46c2-A924-DA07563E4777}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{785E8C55-7CA6-426a-AC89-858827AA4A97}.exeC:\Windows\{785E8C55-7CA6-426a-AC89-858827AA4A97}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CBCD6C4-1CA2-453e-991D-C4C89944C385}.exeC:\Windows\{5CBCD6C4-1CA2-453e-991D-C4C89944C385}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{785E8~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CF13~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{852CD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{585DA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{563FE~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80922~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F695~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{67535~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D6C3~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{285F8~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1D6C3B81-B000-4977-B602-5B9C4A2D7E20}.exe
{1F6959BB-295B-4b56-8ACF-32B94FDB49AA}.exe
{285F8352-50D6-4915-BBBD-D816F6017E7E}.exe
{563FED39-31BC-4d8f-B9F5-859A676B7B8D}.exe
{585DA254-63F2-4db3-87C7-3995855BFD33}.exe
{5CBCD6C4-1CA2-453e-991D-C4C89944C385}.exe
{5CF1317C-2B69-46c2-A924-DA07563E4777}.exe
{675350D5-DF22-4beb-B709-2C536FFE1CDF}.exe
{785E8C55-7CA6-426a-AC89-858827AA4A97}.exe
{8092287A-B7E8-4869-A023-45CCD06F1969}.exe
{852CDB2F-69B3-441b-AC4E-2BF4B4E57DF5}.exe
memory/1640-16-0x0000000000800000-0x0000000000DB3000-memory.dmp
memory/1640-12-0x0000000000800000-0x0000000000DB3000-memory.dmp
memory/2184-63-0x0000000000800000-0x0000000000DB3000-memory.dmp
memory/2184-60-0x0000000000800000-0x0000000000DB3000-memory.dmp
memory/2784-40-0x0000000000780000-0x0000000000D33000-memory.dmp
memory/2784-36-0x0000000000780000-0x0000000000D33000-memory.dmp
memory/2932-28-0x00000000007D0000-0x0000000000D83000-memory.dmp
memory/2932-24-0x00000000007D0000-0x0000000000D83000-memory.dmp
memory/3496-34-0x00000000008B0000-0x0000000000E63000-memory.dmp
memory/3496-30-0x00000000008B0000-0x0000000000E63000-memory.dmp
memory/3928-54-0x0000000000880000-0x0000000000E33000-memory.dmp
memory/3928-57-0x0000000000880000-0x0000000000E33000-memory.dmp
memory/3956-47-0x0000000000820000-0x0000000000DD3000-memory.dmp
memory/3956-42-0x0000000000820000-0x0000000000DD3000-memory.dmp
memory/3988-48-0x00000000009A0000-0x0000000000F53000-memory.dmp
memory/3988-51-0x00000000009A0000-0x0000000000F53000-memory.dmp
memory/4104-18-0x0000000000770000-0x0000000000D23000-memory.dmp
memory/4104-23-0x0000000000770000-0x0000000000D23000-memory.dmp
memory/4564-10-0x0000000000780000-0x0000000000D33000-memory.dmp
memory/4564-6-0x0000000000780000-0x0000000000D33000-memory.dmp
memory/5028-0-0x00000000008B0000-0x0000000000E63000-memory.dmp
memory/5028-4-0x00000000008B0000-0x0000000000E63000-memory.dmp