Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 17:55
General
- Target 2026-06-01_b9da7822cac752ff82df5584a18b8fac_elex_wannacry.exe
- Size 64KB
- Sample260601-why49sdx3r
- SHA256 6f94f07ccadc6d05c636fb900d4b139db6ba510c6cefeded0e1cce781f16f5dc
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 32 IoCs
- Detects Windows executables referencing non-Windows User-Agents 32 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_b9da7822cac752ff82df5584a18b8fac_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_b9da7822cac752ff82df5584a18b8fac_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69300557-15A0-4bdd-8A55-9176D8E2A1FE}.exeC:\Windows\{69300557-15A0-4bdd-8A55-9176D8E2A1FE}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C7D7A0C-940C-49f7-A62B-D096C323E68D}.exeC:\Windows\{8C7D7A0C-940C-49f7-A62B-D096C323E68D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CACF0B7E-D355-444a-8868-8DBCB49BC75F}.exeC:\Windows\{CACF0B7E-D355-444a-8868-8DBCB49BC75F}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60845B92-2191-4070-9FF0-901977CBA0E9}.exeC:\Windows\{60845B92-2191-4070-9FF0-901977CBA0E9}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4162C8F1-4D46-48b3-90B5-2C49BECE55FB}.exeC:\Windows\{4162C8F1-4D46-48b3-90B5-2C49BECE55FB}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B9C97F43-981A-425d-8CBE-A8504C63455F}.exeC:\Windows\{B9C97F43-981A-425d-8CBE-A8504C63455F}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{918D20B3-0CFF-4435-BCFF-F85880ED22D8}.exeC:\Windows\{918D20B3-0CFF-4435-BCFF-F85880ED22D8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7A59BA3-FD8B-4c8d-8141-4F1ACA0666A2}.exeC:\Windows\{A7A59BA3-FD8B-4c8d-8141-4F1ACA0666A2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7051A17E-4AF0-401f-988B-F57C514473DC}.exeC:\Windows\{7051A17E-4AF0-401f-988B-F57C514473DC}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C26C6EB-DEF0-4003-81C8-1F5930086B27}.exeC:\Windows\{1C26C6EB-DEF0-4003-81C8-1F5930086B27}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A5F02D5-0E6A-48f6-8065-546DFBDF5A6D}.exeC:\Windows\{1A5F02D5-0E6A-48f6-8065-546DFBDF5A6D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C26C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7051A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7A59~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{918D2~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B9C97~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4162C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60845~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CACF0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C7D7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69300~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1A5F02D5-0E6A-48f6-8065-546DFBDF5A6D}.exe
{1C26C6EB-DEF0-4003-81C8-1F5930086B27}.exe
{4162C8F1-4D46-48b3-90B5-2C49BECE55FB}.exe
{60845B92-2191-4070-9FF0-901977CBA0E9}.exe
{69300557-15A0-4bdd-8A55-9176D8E2A1FE}.exe
{7051A17E-4AF0-401f-988B-F57C514473DC}.exe
{8C7D7A0C-940C-49f7-A62B-D096C323E68D}.exe
{918D20B3-0CFF-4435-BCFF-F85880ED22D8}.exe
{A7A59BA3-FD8B-4c8d-8141-4F1ACA0666A2}.exe
{B9C97F43-981A-425d-8CBE-A8504C63455F}.exe
{CACF0B7E-D355-444a-8868-8DBCB49BC75F}.exe
memory/844-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/844-38-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2088-62-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2708-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2708-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2708-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2804-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2804-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2892-63-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3372-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3372-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3460-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3792-32-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3936-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3936-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4832-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4832-6-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6036-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6036-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6112-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/6112-13-0x0000000000400000-0x0000000000410000-memory.dmp