Analysis
- max time kernel
146s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 14:02
General
- Target 2026-05-11_c68fc315de6ac362d4a2a54d711e03b5_elex_wannacry.exe
- Size 84KB
- Sample260511-rb643sby3s
- SHA256 4fee7c3b9eb6417cf785a6e74403543bb789f90902aaabdc890654c38d452c1d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 22 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_c68fc315de6ac362d4a2a54d711e03b5_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_c68fc315de6ac362d4a2a54d711e03b5_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{754FC3F5-F5C5-4ae4-9436-2FA39CD111EF}.exeC:\Windows\{754FC3F5-F5C5-4ae4-9436-2FA39CD111EF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D94F1B20-6AF9-4d24-84C6-7E1C3F54E6CA}.exeC:\Windows\{D94F1B20-6AF9-4d24-84C6-7E1C3F54E6CA}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A63FA334-9BED-4719-A668-2B2CDE35B99E}.exeC:\Windows\{A63FA334-9BED-4719-A668-2B2CDE35B99E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA51BFD7-1173-466e-BCBD-DFF387A9F76A}.exeC:\Windows\{DA51BFD7-1173-466e-BCBD-DFF387A9F76A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{28E58E8A-20D4-4a68-AFFD-7C77136DC94E}.exeC:\Windows\{28E58E8A-20D4-4a68-AFFD-7C77136DC94E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0EE1F6F1-F331-4073-9BD3-B3AC714DB487}.exeC:\Windows\{0EE1F6F1-F331-4073-9BD3-B3AC714DB487}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A75A5E2-4D65-4d5f-977D-6927748C4C30}.exeC:\Windows\{0A75A5E2-4D65-4d5f-977D-6927748C4C30}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFF36F90-FF1B-4135-80D5-99F5F2B80283}.exeC:\Windows\{BFF36F90-FF1B-4135-80D5-99F5F2B80283}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44BA9FD3-3DB6-40c8-BAEA-FA7A3F90B7A2}.exeC:\Windows\{44BA9FD3-3DB6-40c8-BAEA-FA7A3F90B7A2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18440629-C5F0-42d8-8035-6AC631D2B527}.exeC:\Windows\{18440629-C5F0-42d8-8035-6AC631D2B527}.exe11⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44BA9~1.EXE > nul11⤵
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFF36~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A75A~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0EE1F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{28E58~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA51B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A63FA~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D94F1~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{754FC~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0A75A5E2-4D65-4d5f-977D-6927748C4C30}.exe
{0EE1F6F1-F331-4073-9BD3-B3AC714DB487}.exe
{18440629-C5F0-42d8-8035-6AC631D2B527}.exe
{28E58E8A-20D4-4a68-AFFD-7C77136DC94E}.exe
{44BA9FD3-3DB6-40c8-BAEA-FA7A3F90B7A2}.exe
{754FC3F5-F5C5-4ae4-9436-2FA39CD111EF}.exe
{A63FA334-9BED-4719-A668-2B2CDE35B99E}.exe
{BFF36F90-FF1B-4135-80D5-99F5F2B80283}.exe
{D94F1B20-6AF9-4d24-84C6-7E1C3F54E6CA}.exe
{DA51BFD7-1173-466e-BCBD-DFF387A9F76A}.exe
memory/436-46-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1044-5-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1044-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1968-28-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2056-51-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3352-34-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4140-10-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4616-58-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4616-54-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4888-22-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4980-16-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5368-40-0x0000000000400000-0x0000000000416000-memory.dmp