Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
28/05/2026, 14:27
General
- Target 2026-05-28_e5cd822d2f89c5f88b5a6783deba7f48_elex_wannacry.exe
- Size 89KB
- Sample260528-rss9jsaz8p
- SHA256 32bce411239895c4e98e3503f192442f768f5b42624f72d1a7ec0483e5a59567
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_e5cd822d2f89c5f88b5a6783deba7f48_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_e5cd822d2f89c5f88b5a6783deba7f48_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{99EA75ED-EE08-4a46-BC72-C20076A3C6D6}.exeC:\Windows\{99EA75ED-EE08-4a46-BC72-C20076A3C6D6}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A430E4EA-5DCC-4478-A4D2-A9EACA4B2774}.exeC:\Windows\{A430E4EA-5DCC-4478-A4D2-A9EACA4B2774}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{809AEB5C-E269-4111-8A68-53425CEFE65A}.exeC:\Windows\{809AEB5C-E269-4111-8A68-53425CEFE65A}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1023E1F7-B9E7-4504-992D-C19745CADFC4}.exeC:\Windows\{1023E1F7-B9E7-4504-992D-C19745CADFC4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C3E9056-2ACB-45d0-8D99-4C0C6B72D13E}.exeC:\Windows\{0C3E9056-2ACB-45d0-8D99-4C0C6B72D13E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE7DD5FC-C960-4df5-A5C6-9D15D78EFAA6}.exeC:\Windows\{EE7DD5FC-C960-4df5-A5C6-9D15D78EFAA6}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8ACA239E-8C16-45fd-9B5B-9673DD8469DB}.exeC:\Windows\{8ACA239E-8C16-45fd-9B5B-9673DD8469DB}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C8C06E32-1B2F-416a-AF82-E60748854D3E}.exeC:\Windows\{C8C06E32-1B2F-416a-AF82-E60748854D3E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{484CF93B-6FD7-474d-B4DA-EEC84C4C1CD0}.exeC:\Windows\{484CF93B-6FD7-474d-B4DA-EEC84C4C1CD0}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A3631671-8D4B-443b-BD64-87640479EE57}.exeC:\Windows\{A3631671-8D4B-443b-BD64-87640479EE57}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{484CF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C8C06~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8ACA2~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE7DD~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C3E9~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1023E~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{809AE~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A430E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{99EA7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0C3E9056-2ACB-45d0-8D99-4C0C6B72D13E}.exe
{1023E1F7-B9E7-4504-992D-C19745CADFC4}.exe
{484CF93B-6FD7-474d-B4DA-EEC84C4C1CD0}.exe
{809AEB5C-E269-4111-8A68-53425CEFE65A}.exe
{8ACA239E-8C16-45fd-9B5B-9673DD8469DB}.exe
{99EA75ED-EE08-4a46-BC72-C20076A3C6D6}.exe
{A3631671-8D4B-443b-BD64-87640479EE57}.exe
{A430E4EA-5DCC-4478-A4D2-A9EACA4B2774}.exe
{C8C06E32-1B2F-416a-AF82-E60748854D3E}.exe
{EE7DD5FC-C960-4df5-A5C6-9D15D78EFAA6}.exe