Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 08:24
General
- Target 2026-06-02_1f006d734589c7f5a7448b4319eb8b8d_elex_wannacry.exe
- Size 60KB
- Sample260602-kap1vah18m
- SHA256 a38a9eecc1a47ee68fc76862e9da02474b4b217dced3042ba4491c727d4e79e3
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 33 IoCs
- Detects Windows executables referencing non-Windows User-Agents 33 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_1f006d734589c7f5a7448b4319eb8b8d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_1f006d734589c7f5a7448b4319eb8b8d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{766278DE-DC1B-450d-AA7E-E33F1C65E31B}.exeC:\Windows\{766278DE-DC1B-450d-AA7E-E33F1C65E31B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CD91F82C-F950-4532-BBE2-1FF6E1131918}.exeC:\Windows\{CD91F82C-F950-4532-BBE2-1FF6E1131918}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{685C98B5-89ED-422b-8F16-0E0DB4AFE365}.exeC:\Windows\{685C98B5-89ED-422b-8F16-0E0DB4AFE365}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0817F4F4-156D-443f-A5B9-04F1107E070A}.exeC:\Windows\{0817F4F4-156D-443f-A5B9-04F1107E070A}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA8A6442-9AB6-456d-8775-B54F50311153}.exeC:\Windows\{CA8A6442-9AB6-456d-8775-B54F50311153}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8231393A-FB71-4004-8D44-6209193F3040}.exeC:\Windows\{8231393A-FB71-4004-8D44-6209193F3040}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3CF095BC-A104-4bbe-8102-91ED2214A004}.exeC:\Windows\{3CF095BC-A104-4bbe-8102-91ED2214A004}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DD5C3D3A-DE21-482e-98A4-2365D1379B9C}.exeC:\Windows\{DD5C3D3A-DE21-482e-98A4-2365D1379B9C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5AF8690D-C84C-4f31-93F9-AFC8A5DA8184}.exeC:\Windows\{5AF8690D-C84C-4f31-93F9-AFC8A5DA8184}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1AC0C731-0229-4a5d-A81B-06750C9E3213}.exeC:\Windows\{1AC0C731-0229-4a5d-A81B-06750C9E3213}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{67C15C3C-BDE5-4fad-B565-9680DAB26DD9}.exeC:\Windows\{67C15C3C-BDE5-4fad-B565-9680DAB26DD9}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1AC0C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5AF86~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DD5C3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3CF09~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{82313~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA8A6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0817F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{685C9~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CD91F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76627~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0817F4F4-156D-443f-A5B9-04F1107E070A}.exe
{1AC0C731-0229-4a5d-A81B-06750C9E3213}.exe
{3CF095BC-A104-4bbe-8102-91ED2214A004}.exe
{5AF8690D-C84C-4f31-93F9-AFC8A5DA8184}.exe
{67C15C3C-BDE5-4fad-B565-9680DAB26DD9}.exe
{685C98B5-89ED-422b-8F16-0E0DB4AFE365}.exe
{766278DE-DC1B-450d-AA7E-E33F1C65E31B}.exe
{8231393A-FB71-4004-8D44-6209193F3040}.exe
{CA8A6442-9AB6-456d-8775-B54F50311153}.exe
{CD91F82C-F950-4532-BBE2-1FF6E1131918}.exe
{DD5C3D3A-DE21-482e-98A4-2365D1379B9C}.exe
memory/1528-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1528-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2628-64-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2628-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2632-39-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2632-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2724-53-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2724-60-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3960-11-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3960-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3984-13-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3984-16-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4440-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4440-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4440-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4752-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4752-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4880-34-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4880-30-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4944-51-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4944-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5092-22-0x0000000000400000-0x0000000000410000-memory.dmp