Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 02:29
General
- Target 2026-06-02_f08f4c41ed27966ab1a5b044b965cc31_elex_wannacry.exe
- Size 64KB
- Sample260602-cy2qjsds5p
- SHA256 37e443d11612397f524a13e86998a5ca22864084fdbd25a8dc64365598965933
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 27 IoCs
- Detects Windows executables referencing non-Windows User-Agents 27 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_f08f4c41ed27966ab1a5b044b965cc31_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_f08f4c41ed27966ab1a5b044b965cc31_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F4C3C9F9-77A9-4dc4-89A6-31F7751D5B80}.exeC:\Windows\{F4C3C9F9-77A9-4dc4-89A6-31F7751D5B80}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{01B6F16D-4384-4037-BA1E-6C49F7FBDB5D}.exeC:\Windows\{01B6F16D-4384-4037-BA1E-6C49F7FBDB5D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76DF8386-80F4-49db-B4EF-4AC7A840F374}.exeC:\Windows\{76DF8386-80F4-49db-B4EF-4AC7A840F374}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F153BB0-CD73-46ec-8DE0-9C0735CD7835}.exeC:\Windows\{2F153BB0-CD73-46ec-8DE0-9C0735CD7835}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10E2B668-27D2-4e9b-A904-616549150C2D}.exeC:\Windows\{10E2B668-27D2-4e9b-A904-616549150C2D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9AD5A6D0-37BE-4c7a-9534-F049FDF211F9}.exeC:\Windows\{9AD5A6D0-37BE-4c7a-9534-F049FDF211F9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E0CC4BE-8772-421a-8F0B-84DAA208FE98}.exeC:\Windows\{1E0CC4BE-8772-421a-8F0B-84DAA208FE98}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{670AA011-8FEF-4960-AFFB-03E08C84D7A2}.exeC:\Windows\{670AA011-8FEF-4960-AFFB-03E08C84D7A2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F5E374C-0D08-419d-9F7B-3E9D2A54E3D2}.exeC:\Windows\{0F5E374C-0D08-419d-9F7B-3E9D2A54E3D2}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8A0F46B-9859-4166-BE71-CDC9E1DE379A}.exeC:\Windows\{D8A0F46B-9859-4166-BE71-CDC9E1DE379A}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F5E3~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{670AA~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E0CC~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9AD5A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10E2B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F153~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76DF8~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{01B6F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4C3C~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{01B6F16D-4384-4037-BA1E-6C49F7FBDB5D}.exe
{0F5E374C-0D08-419d-9F7B-3E9D2A54E3D2}.exe
{10E2B668-27D2-4e9b-A904-616549150C2D}.exe
{1E0CC4BE-8772-421a-8F0B-84DAA208FE98}.exe
{2F153BB0-CD73-46ec-8DE0-9C0735CD7835}.exe
{670AA011-8FEF-4960-AFFB-03E08C84D7A2}.exe
{76DF8386-80F4-49db-B4EF-4AC7A840F374}.exe
{9AD5A6D0-37BE-4c7a-9534-F049FDF211F9}.exe
{D8A0F46B-9859-4166-BE71-CDC9E1DE379A}.exe
{F4C3C9F9-77A9-4dc4-89A6-31F7751D5B80}.exe
memory/1320-23-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1320-27-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1396-17-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1636-37-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1652-49-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1652-44-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1708-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1708-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1708-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1848-33-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2172-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2796-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2796-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2796-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2832-42-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3704-22-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4632-55-0x0000000000400000-0x0000000000410000-memory.dmp