Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 10:50
General
- Target 2026-05-11_b5408dbf7a4e7cea18e3a9a761a70619_elex_wannacry.exe
- Size 84KB
- Sample260511-mxawjsa19l
- SHA256 71f36b145491e5698853caf99fe9461fe688cf53a2e71c20982257d16db17c5c
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 24 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_b5408dbf7a4e7cea18e3a9a761a70619_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_b5408dbf7a4e7cea18e3a9a761a70619_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74B082E5-C803-4084-9595-C4C6CE61BAB0}.exeC:\Windows\{74B082E5-C803-4084-9595-C4C6CE61BAB0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B67D96A2-3BF6-413d-9F65-C7287426B39D}.exeC:\Windows\{B67D96A2-3BF6-413d-9F65-C7287426B39D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11FEFBA3-3642-42a9-86C0-97B0F2812473}.exeC:\Windows\{11FEFBA3-3642-42a9-86C0-97B0F2812473}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{176D3B63-54A0-4f44-8F8B-60A73730A33E}.exeC:\Windows\{176D3B63-54A0-4f44-8F8B-60A73730A33E}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{809918AD-069B-4f38-879C-238BE68B7AC6}.exeC:\Windows\{809918AD-069B-4f38-879C-238BE68B7AC6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5FC2B8F4-3F1E-4a9a-8FBD-94A4C1B0D4E2}.exeC:\Windows\{5FC2B8F4-3F1E-4a9a-8FBD-94A4C1B0D4E2}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8EF639CC-9844-43e8-85E8-0371ADD1F924}.exeC:\Windows\{8EF639CC-9844-43e8-85E8-0371ADD1F924}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3EB5D4E8-8ABB-4ba9-9A2E-5B4ABD9C20CE}.exeC:\Windows\{3EB5D4E8-8ABB-4ba9-9A2E-5B4ABD9C20CE}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB1F570C-66BA-429c-A457-AD03C23DBBF4}.exeC:\Windows\{FB1F570C-66BA-429c-A457-AD03C23DBBF4}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4B02A37-EE30-493d-8FBA-92A1B7F5AE42}.exeC:\Windows\{A4B02A37-EE30-493d-8FBA-92A1B7F5AE42}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9A00D6B1-5040-402a-A1D0-06795BE413E6}.exeC:\Windows\{9A00D6B1-5040-402a-A1D0-06795BE413E6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4B02~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB1F5~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3EB5D~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EF63~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5FC2B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80991~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{176D3~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11FEF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B67D9~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74B08~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{11FEFBA3-3642-42a9-86C0-97B0F2812473}.exe
{176D3B63-54A0-4f44-8F8B-60A73730A33E}.exe
{3EB5D4E8-8ABB-4ba9-9A2E-5B4ABD9C20CE}.exe
{5FC2B8F4-3F1E-4a9a-8FBD-94A4C1B0D4E2}.exe
{74B082E5-C803-4084-9595-C4C6CE61BAB0}.exe
{809918AD-069B-4f38-879C-238BE68B7AC6}.exe
{8EF639CC-9844-43e8-85E8-0371ADD1F924}.exe
{9A00D6B1-5040-402a-A1D0-06795BE413E6}.exe
{A4B02A37-EE30-493d-8FBA-92A1B7F5AE42}.exe
{B67D96A2-3BF6-413d-9F65-C7287426B39D}.exe
{FB1F570C-66BA-429c-A457-AD03C23DBBF4}.exe
memory/1304-9-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1568-22-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1596-16-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1596-12-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1788-34-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2128-65-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2180-58-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3584-28-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3700-52-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4524-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4524-5-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4844-47-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5480-40-0x0000000000400000-0x0000000000416000-memory.dmp