Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 10:44
General
- Target 2026-05-11_91dc9e76696c81fb0ead0d5327592aa2_elex_wannacry.exe
- Size 372KB
- Sample260511-ms2hpsaz6j
- SHA256 69863af731c17413ff0ddf38a1dc4ea340600370b97ba235d82d3d992c50e56a
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_91dc9e76696c81fb0ead0d5327592aa2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_91dc9e76696c81fb0ead0d5327592aa2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E59192E9-7682-4127-95B1-1BE31204AE18}.exeC:\Windows\{E59192E9-7682-4127-95B1-1BE31204AE18}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4FE87A18-85CE-4683-978F-BC8CD28D553B}.exeC:\Windows\{4FE87A18-85CE-4683-978F-BC8CD28D553B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D63E56DE-835E-44c1-A41E-779D191FED1E}.exeC:\Windows\{D63E56DE-835E-44c1-A41E-779D191FED1E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76C6EFB1-36E5-4862-9250-78441F595D7F}.exeC:\Windows\{76C6EFB1-36E5-4862-9250-78441F595D7F}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CD8C675-15F0-4816-8A92-8A0E4247FC3E}.exeC:\Windows\{9CD8C675-15F0-4816-8A92-8A0E4247FC3E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBF55D8E-0370-4769-A0FB-36A80AB637F6}.exeC:\Windows\{CBF55D8E-0370-4769-A0FB-36A80AB637F6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04A84419-BE13-4254-8F81-AD7DD917C6F0}.exeC:\Windows\{04A84419-BE13-4254-8F81-AD7DD917C6F0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F781139-5279-4352-80DF-03F93EC96538}.exeC:\Windows\{9F781139-5279-4352-80DF-03F93EC96538}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{53EE9487-138A-4d08-AD5B-D4CD4E2CFC16}.exeC:\Windows\{53EE9487-138A-4d08-AD5B-D4CD4E2CFC16}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17E2B52D-2B1F-44bf-ABB0-F0EA14C0DAE6}.exeC:\Windows\{17E2B52D-2B1F-44bf-ABB0-F0EA14C0DAE6}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{53EE9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F781~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04A84~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CBF55~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CD8C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76C6E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D63E5~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4FE87~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5919~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{04A84419-BE13-4254-8F81-AD7DD917C6F0}.exe
{17E2B52D-2B1F-44bf-ABB0-F0EA14C0DAE6}.exe
{4FE87A18-85CE-4683-978F-BC8CD28D553B}.exe
{53EE9487-138A-4d08-AD5B-D4CD4E2CFC16}.exe
{76C6EFB1-36E5-4862-9250-78441F595D7F}.exe
{9CD8C675-15F0-4816-8A92-8A0E4247FC3E}.exe
{9F781139-5279-4352-80DF-03F93EC96538}.exe
{CBF55D8E-0370-4769-A0FB-36A80AB637F6}.exe
{D63E56DE-835E-44c1-A41E-779D191FED1E}.exe
{E59192E9-7682-4127-95B1-1BE31204AE18}.exe
memory/1072-10-0x0000000000940000-0x0000000000F42000-memory.dmp
memory/1072-6-0x0000000000940000-0x0000000000F42000-memory.dmp
memory/1244-52-0x00000000008B0000-0x0000000000EB2000-memory.dmp
memory/1244-48-0x00000000008B0000-0x0000000000EB2000-memory.dmp
memory/1292-0-0x0000000000B00000-0x0000000001102000-memory.dmp
memory/1292-4-0x0000000000B00000-0x0000000001102000-memory.dmp
memory/1552-36-0x0000000000870000-0x0000000000E72000-memory.dmp
memory/1552-40-0x0000000000870000-0x0000000000E72000-memory.dmp
memory/1572-54-0x0000000000910000-0x0000000000F12000-memory.dmp
memory/1572-58-0x0000000000910000-0x0000000000F12000-memory.dmp
memory/2100-30-0x0000000000910000-0x0000000000F12000-memory.dmp
memory/2100-34-0x0000000000910000-0x0000000000F12000-memory.dmp
memory/2228-28-0x0000000000870000-0x0000000000E72000-memory.dmp
memory/2228-24-0x0000000000870000-0x0000000000E72000-memory.dmp
memory/2616-15-0x0000000000870000-0x0000000000E72000-memory.dmp
memory/2616-12-0x0000000000870000-0x0000000000E72000-memory.dmp
memory/3828-22-0x0000000000870000-0x0000000000E72000-memory.dmp
memory/3828-18-0x0000000000870000-0x0000000000E72000-memory.dmp
memory/3972-47-0x0000000000890000-0x0000000000E92000-memory.dmp
memory/3972-42-0x0000000000890000-0x0000000000E92000-memory.dmp