Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 08:50
General
- Target 2026-05-28_d158966d3d1ea8c3092011d7646b9073_elex_wannacry.exe
- Size 79KB
- Sample260528-krss3aa19r
- SHA256 a6cbe13faa1a35551f41d6f4b9aba2a483ea9e76cff4f7a01e56ebfd2f42f84c
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_d158966d3d1ea8c3092011d7646b9073_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_d158966d3d1ea8c3092011d7646b9073_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA277153-8A31-4817-9037-FBF6F35A802F}.exeC:\Windows\{BA277153-8A31-4817-9037-FBF6F35A802F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B008D44C-7019-45da-99E5-CA901657732D}.exeC:\Windows\{B008D44C-7019-45da-99E5-CA901657732D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8DA54799-2BF6-498a-A1FA-C9B456610E5E}.exeC:\Windows\{8DA54799-2BF6-498a-A1FA-C9B456610E5E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9E7D8C84-4A6F-49cb-9DE4-F893420ED2C6}.exeC:\Windows\{9E7D8C84-4A6F-49cb-9DE4-F893420ED2C6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B002DBE9-06DA-41f3-8E5A-6DF618D2353F}.exeC:\Windows\{B002DBE9-06DA-41f3-8E5A-6DF618D2353F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{70D27FA0-867C-4b5b-843A-76FF8C42A646}.exeC:\Windows\{70D27FA0-867C-4b5b-843A-76FF8C42A646}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BA733311-80A4-4fff-946E-82687BF13AF9}.exeC:\Windows\{BA733311-80A4-4fff-946E-82687BF13AF9}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EC641F1C-0E5C-489b-A8F5-DD49948775F0}.exeC:\Windows\{EC641F1C-0E5C-489b-A8F5-DD49948775F0}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9E6B47A-7078-4dee-A415-F1D3C21476ED}.exeC:\Windows\{B9E6B47A-7078-4dee-A415-F1D3C21476ED}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC23A5E0-60FC-4867-BABD-762CF329CC46}.exeC:\Windows\{DC23A5E0-60FC-4867-BABD-762CF329CC46}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C63DBBD-3A60-4210-A0B9-0C61551B4E82}.exeC:\Windows\{0C63DBBD-3A60-4210-A0B9-0C61551B4E82}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC23A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9E6B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EC641~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA733~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{70D27~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B002D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9E7D8~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8DA54~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B008D~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BA277~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0C63DBBD-3A60-4210-A0B9-0C61551B4E82}.exe
{70D27FA0-867C-4b5b-843A-76FF8C42A646}.exe
{8DA54799-2BF6-498a-A1FA-C9B456610E5E}.exe
{9E7D8C84-4A6F-49cb-9DE4-F893420ED2C6}.exe
{B002DBE9-06DA-41f3-8E5A-6DF618D2353F}.exe
{B008D44C-7019-45da-99E5-CA901657732D}.exe
{B9E6B47A-7078-4dee-A415-F1D3C21476ED}.exe
{BA277153-8A31-4817-9037-FBF6F35A802F}.exe
{BA733311-80A4-4fff-946E-82687BF13AF9}.exe
{DC23A5E0-60FC-4867-BABD-762CF329CC46}.exe
{EC641F1C-0E5C-489b-A8F5-DD49948775F0}.exe