Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 07:34
General
- Target 2026-06-02_3a256f5161c3f41262ead94de0e1e902_elex_wannacry.exe
- Size 90KB
- Sample260602-jd5p2af18v
- SHA256 5b934081a33d3c18e2a413b950243a8a2a1404373d371d8556133d95dabe0c64
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_3a256f5161c3f41262ead94de0e1e902_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_3a256f5161c3f41262ead94de0e1e902_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CC8EADF5-2687-44da-9FDC-12D1C11B89D8}.exeC:\Windows\{CC8EADF5-2687-44da-9FDC-12D1C11B89D8}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D3F949A5-C7AE-40ca-B456-9AE7651F4C2D}.exeC:\Windows\{D3F949A5-C7AE-40ca-B456-9AE7651F4C2D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{166A94E9-2962-4890-B6E2-F65DA907B2E7}.exeC:\Windows\{166A94E9-2962-4890-B6E2-F65DA907B2E7}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{462A6CDB-C666-41d1-B2A3-E0CE11299DA0}.exeC:\Windows\{462A6CDB-C666-41d1-B2A3-E0CE11299DA0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F37FE7D0-8D92-432d-B506-4385F7369F20}.exeC:\Windows\{F37FE7D0-8D92-432d-B506-4385F7369F20}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24E307E2-772B-44c1-B0E1-F980E75A25C5}.exeC:\Windows\{24E307E2-772B-44c1-B0E1-F980E75A25C5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6362DE18-0CCB-45f7-8A84-D062E767675A}.exeC:\Windows\{6362DE18-0CCB-45f7-8A84-D062E767675A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EE10FD30-68E5-40e0-AEA6-1ADA8B322F12}.exeC:\Windows\{EE10FD30-68E5-40e0-AEA6-1ADA8B322F12}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5531FE4-FE01-449a-B078-09CFE35E4409}.exeC:\Windows\{F5531FE4-FE01-449a-B078-09CFE35E4409}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B8EC2EEF-97A4-49e3-BB90-79BA796312D7}.exeC:\Windows\{B8EC2EEF-97A4-49e3-BB90-79BA796312D7}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5531~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EE10F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6362D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24E30~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F37FE~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{462A6~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{166A9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D3F94~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CC8EA~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{166A94E9-2962-4890-B6E2-F65DA907B2E7}.exe
{24E307E2-772B-44c1-B0E1-F980E75A25C5}.exe
{462A6CDB-C666-41d1-B2A3-E0CE11299DA0}.exe
{6362DE18-0CCB-45f7-8A84-D062E767675A}.exe
{B8EC2EEF-97A4-49e3-BB90-79BA796312D7}.exe
{CC8EADF5-2687-44da-9FDC-12D1C11B89D8}.exe
{D3F949A5-C7AE-40ca-B456-9AE7651F4C2D}.exe
{EE10FD30-68E5-40e0-AEA6-1ADA8B322F12}.exe
{F37FE7D0-8D92-432d-B506-4385F7369F20}.exe
{F5531FE4-FE01-449a-B078-09CFE35E4409}.exe