Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
16/05/2026, 14:35
General
- Target 2026-05-16_ddfa1682de94556ba8a65ce06a632790_elex_wannacry.exe
- Size 91KB
- Sample260516-rye9waez61
- SHA256 0a554eba3a2f0b26098a5e4c9ab0c5acf5d6ac5bf691019925edb43ad8b6775c
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_ddfa1682de94556ba8a65ce06a632790_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_ddfa1682de94556ba8a65ce06a632790_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BFB61ADD-ABEB-4a04-A549-B07CDB38BDBF}.exeC:\Windows\{BFB61ADD-ABEB-4a04-A549-B07CDB38BDBF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0C63201-AE1C-4496-9FAE-381AD1A46B18}.exeC:\Windows\{F0C63201-AE1C-4496-9FAE-381AD1A46B18}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{670BFA85-9EAF-4e42-B05F-FEEBBFFE2310}.exeC:\Windows\{670BFA85-9EAF-4e42-B05F-FEEBBFFE2310}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{38C5F0D1-9447-4cc4-AD2D-84EE5783C4B6}.exeC:\Windows\{38C5F0D1-9447-4cc4-AD2D-84EE5783C4B6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{96908F6C-2F67-49ce-9300-3239DA82DA98}.exeC:\Windows\{96908F6C-2F67-49ce-9300-3239DA82DA98}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA4FFCF5-5027-4562-8E32-588E737FECC4}.exeC:\Windows\{DA4FFCF5-5027-4562-8E32-588E737FECC4}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C702B64-2FA6-4315-9856-E6FFC09114D4}.exeC:\Windows\{6C702B64-2FA6-4315-9856-E6FFC09114D4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FE88B7F-CAE0-49ad-A9C6-D9D9B8C7E875}.exeC:\Windows\{8FE88B7F-CAE0-49ad-A9C6-D9D9B8C7E875}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{858014D3-EC69-4a09-BB93-10D9627EA4E6}.exeC:\Windows\{858014D3-EC69-4a09-BB93-10D9627EA4E6}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3F6E603E-244B-4803-8BB8-0ACC3AF53B95}.exeC:\Windows\{3F6E603E-244B-4803-8BB8-0ACC3AF53B95}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6C8E01A-BCA2-44db-8078-B8E91F6E4C55}.exeC:\Windows\{C6C8E01A-BCA2-44db-8078-B8E91F6E4C55}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3F6E6~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85801~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FE88~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C702~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA4FF~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{96908~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{38C5F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{670BF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0C63~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BFB61~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{38C5F0D1-9447-4cc4-AD2D-84EE5783C4B6}.exe
{3F6E603E-244B-4803-8BB8-0ACC3AF53B95}.exe
{670BFA85-9EAF-4e42-B05F-FEEBBFFE2310}.exe
{6C702B64-2FA6-4315-9856-E6FFC09114D4}.exe
{858014D3-EC69-4a09-BB93-10D9627EA4E6}.exe
{8FE88B7F-CAE0-49ad-A9C6-D9D9B8C7E875}.exe
{96908F6C-2F67-49ce-9300-3239DA82DA98}.exe
{BFB61ADD-ABEB-4a04-A549-B07CDB38BDBF}.exe
{C6C8E01A-BCA2-44db-8078-B8E91F6E4C55}.exe
{DA4FFCF5-5027-4562-8E32-588E737FECC4}.exe
{F0C63201-AE1C-4496-9FAE-381AD1A46B18}.exe