Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 19:43
General
- Target 2026-05-11_378fefd65a6560cf2c50b6193955acf3_elex_wannacry.exe
- Size 116KB
- Sample260511-yfap1aht2v
- SHA256 ef775d17e62b20e64441452d519680f0be14bf2a01215ff74ff404489bdb7e66
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_378fefd65a6560cf2c50b6193955acf3_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_378fefd65a6560cf2c50b6193955acf3_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{83E453DC-EF00-4fd3-8578-96EFF8F1B2E3}.exeC:\Windows\{83E453DC-EF00-4fd3-8578-96EFF8F1B2E3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4871795A-D5E7-49c8-BE84-A9FE74A57AD0}.exeC:\Windows\{4871795A-D5E7-49c8-BE84-A9FE74A57AD0}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F38FB757-4E71-427b-A3D5-BE54A9C2578C}.exeC:\Windows\{F38FB757-4E71-427b-A3D5-BE54A9C2578C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20E16180-B91E-4922-950B-324AD7E52905}.exeC:\Windows\{20E16180-B91E-4922-950B-324AD7E52905}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2CA9E4A1-55BD-4321-8A4D-7F2C0A10D93E}.exeC:\Windows\{2CA9E4A1-55BD-4321-8A4D-7F2C0A10D93E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA2B88AB-47E0-44ab-9C8D-63E341EDDD00}.exeC:\Windows\{CA2B88AB-47E0-44ab-9C8D-63E341EDDD00}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{19F05C00-ECD4-442e-9431-6021CB3168F4}.exeC:\Windows\{19F05C00-ECD4-442e-9431-6021CB3168F4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8F9B4E13-573A-439f-9357-126AB7470413}.exeC:\Windows\{8F9B4E13-573A-439f-9357-126AB7470413}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{62965C5E-A551-439d-98B9-62A65CD3E43F}.exeC:\Windows\{62965C5E-A551-439d-98B9-62A65CD3E43F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50D5D6A5-DB74-4a62-A46F-9C6FC56B3DA4}.exeC:\Windows\{50D5D6A5-DB74-4a62-A46F-9C6FC56B3DA4}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{62965~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8F9B4~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{19F05~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA2B8~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2CA9E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20E16~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F38FB~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48717~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83E45~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{19F05C00-ECD4-442e-9431-6021CB3168F4}.exe
{20E16180-B91E-4922-950B-324AD7E52905}.exe
{2CA9E4A1-55BD-4321-8A4D-7F2C0A10D93E}.exe
{4871795A-D5E7-49c8-BE84-A9FE74A57AD0}.exe
{50D5D6A5-DB74-4a62-A46F-9C6FC56B3DA4}.exe
{62965C5E-A551-439d-98B9-62A65CD3E43F}.exe
{83E453DC-EF00-4fd3-8578-96EFF8F1B2E3}.exe
{8F9B4E13-573A-439f-9357-126AB7470413}.exe
{CA2B88AB-47E0-44ab-9C8D-63E341EDDD00}.exe
{F38FB757-4E71-427b-A3D5-BE54A9C2578C}.exe
memory/1272-42-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/1272-46-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/1444-11-0x0000000000690000-0x00000000006B5000-memory.dmp
memory/1444-6-0x0000000000690000-0x00000000006B5000-memory.dmp
memory/1720-58-0x0000000000A50000-0x0000000000A75000-memory.dmp
memory/1720-54-0x0000000000A50000-0x0000000000A75000-memory.dmp
memory/2824-12-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/2824-15-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/3124-36-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/3124-40-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/3384-18-0x0000000000BB0000-0x0000000000BD5000-memory.dmp
memory/3384-22-0x0000000000BB0000-0x0000000000BD5000-memory.dmp
memory/4040-24-0x0000000000A40000-0x0000000000A65000-memory.dmp
memory/4040-28-0x0000000000A40000-0x0000000000A65000-memory.dmp
memory/4104-0-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/4104-5-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/4648-30-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/4648-34-0x0000000000B70000-0x0000000000B95000-memory.dmp
memory/4852-52-0x0000000000A30000-0x0000000000A55000-memory.dmp
memory/4852-48-0x0000000000A30000-0x0000000000A55000-memory.dmp