Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 03:20
General
- Target 2026-06-02_8fe72ea7c0f0ded1c707912298a9ba6a_elex_wannacry.exe
- Size 91KB
- Sample260602-dvt2zad14j
- SHA256 d2859239881d6e89ed25db36428f299ef181d1f352f083adf0ae8a3a06510702
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 30 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_8fe72ea7c0f0ded1c707912298a9ba6a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_8fe72ea7c0f0ded1c707912298a9ba6a_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DBDD2578-21AB-4771-96AB-6783C8E4BEF2}.exeC:\Windows\{DBDD2578-21AB-4771-96AB-6783C8E4BEF2}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8AB8568D-C48C-4589-90F7-DBAAC9507914}.exeC:\Windows\{8AB8568D-C48C-4589-90F7-DBAAC9507914}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D8C92C4-18CD-4c2b-B385-FF1A21D48FAE}.exeC:\Windows\{5D8C92C4-18CD-4c2b-B385-FF1A21D48FAE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DE47BF19-F5F0-4afe-970D-7268D2D6DCF7}.exeC:\Windows\{DE47BF19-F5F0-4afe-970D-7268D2D6DCF7}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{23A8CF06-1CF2-45b2-81EE-324A1CE7B073}.exeC:\Windows\{23A8CF06-1CF2-45b2-81EE-324A1CE7B073}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{82E7F082-F5F2-445b-855B-8F3C6C7A1093}.exeC:\Windows\{82E7F082-F5F2-445b-855B-8F3C6C7A1093}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37394805-BEE5-42de-8CBB-A1624B3B38E0}.exeC:\Windows\{37394805-BEE5-42de-8CBB-A1624B3B38E0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C15090B-3DDF-4c5b-A208-C67DE12F4F24}.exeC:\Windows\{1C15090B-3DDF-4c5b-A208-C67DE12F4F24}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76D68C36-5F2F-4a63-B81F-70DD20260798}.exeC:\Windows\{76D68C36-5F2F-4a63-B81F-70DD20260798}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{203D3B6B-A79E-4ba9-A14D-24C1BBEE428B}.exeC:\Windows\{203D3B6B-A79E-4ba9-A14D-24C1BBEE428B}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76D68~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C150~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37394~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82E7F~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23A8C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DE47B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D8C9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8AB85~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DBDD2~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1C15090B-3DDF-4c5b-A208-C67DE12F4F24}.exe
{203D3B6B-A79E-4ba9-A14D-24C1BBEE428B}.exe
{23A8CF06-1CF2-45b2-81EE-324A1CE7B073}.exe
{37394805-BEE5-42de-8CBB-A1624B3B38E0}.exe
{5D8C92C4-18CD-4c2b-B385-FF1A21D48FAE}.exe
{76D68C36-5F2F-4a63-B81F-70DD20260798}.exe
{82E7F082-F5F2-445b-855B-8F3C6C7A1093}.exe
{8AB8568D-C48C-4589-90F7-DBAAC9507914}.exe
{DBDD2578-21AB-4771-96AB-6783C8E4BEF2}.exe
{DE47BF19-F5F0-4afe-970D-7268D2D6DCF7}.exe
memory/240-51-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2152-58-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2508-17-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2508-13-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2516-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2516-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2516-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3008-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3008-40-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3856-57-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3856-53-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4996-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5224-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5224-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5660-24-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5660-20-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5772-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5772-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5772-12-0x0000000000400000-0x0000000000411000-memory.dmp
memory/5860-33-0x0000000000400000-0x0000000000411000-memory.dmp