Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 14:21
General
- Target 2026-06-02_a4d0590d552c479943cea6ecefcf30fa_elex_wannacry.exe
- Size 84KB
- Sample260602-rn21wsfv5x
- SHA256 c6ba33b52837a4e4658fb571b69af258d1129940336cf714672583c84dba53d7
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 24 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_a4d0590d552c479943cea6ecefcf30fa_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_a4d0590d552c479943cea6ecefcf30fa_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1778F37-766C-4ae6-94FE-720A132DDCCB}.exeC:\Windows\{A1778F37-766C-4ae6-94FE-720A132DDCCB}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{93B6FD25-EAF5-484b-8B01-796A197A0205}.exeC:\Windows\{93B6FD25-EAF5-484b-8B01-796A197A0205}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8CBCA16E-6E39-4724-803F-F870525A6403}.exeC:\Windows\{8CBCA16E-6E39-4724-803F-F870525A6403}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8C6F184-A9CF-45ec-B3B5-53979B821FDE}.exeC:\Windows\{A8C6F184-A9CF-45ec-B3B5-53979B821FDE}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{190EF522-31EE-4a64-A609-D547698FC12E}.exeC:\Windows\{190EF522-31EE-4a64-A609-D547698FC12E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E228A17A-009B-4ce3-A36F-525580FCCEFD}.exeC:\Windows\{E228A17A-009B-4ce3-A36F-525580FCCEFD}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0D5336DF-D904-43e2-B1B5-C447E0E2A961}.exeC:\Windows\{0D5336DF-D904-43e2-B1B5-C447E0E2A961}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50E3607A-D530-4d8b-AC93-5230ED369E7E}.exeC:\Windows\{50E3607A-D530-4d8b-AC93-5230ED369E7E}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A57B3201-40BA-43fa-8E58-A8572AE4813B}.exeC:\Windows\{A57B3201-40BA-43fa-8E58-A8572AE4813B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84924114-7CE5-4297-8455-0C4F51644286}.exeC:\Windows\{84924114-7CE5-4297-8455-0C4F51644286}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C4A2368-0AA5-4d2d-A15D-F45514D8216C}.exeC:\Windows\{1C4A2368-0AA5-4d2d-A15D-F45514D8216C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84924~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A57B3~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50E36~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0D533~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E228A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{190EF~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8C6F~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8CBCA~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{93B6F~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1778~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0D5336DF-D904-43e2-B1B5-C447E0E2A961}.exe
{190EF522-31EE-4a64-A609-D547698FC12E}.exe
{1C4A2368-0AA5-4d2d-A15D-F45514D8216C}.exe
{50E3607A-D530-4d8b-AC93-5230ED369E7E}.exe
{84924114-7CE5-4297-8455-0C4F51644286}.exe
{8CBCA16E-6E39-4724-803F-F870525A6403}.exe
{93B6FD25-EAF5-484b-8B01-796A197A0205}.exe
{A1778F37-766C-4ae6-94FE-720A132DDCCB}.exe
{A57B3201-40BA-43fa-8E58-A8572AE4813B}.exe
{A8C6F184-A9CF-45ec-B3B5-53979B821FDE}.exe
{E228A17A-009B-4ce3-A36F-525580FCCEFD}.exe
memory/1744-46-0x0000000000400000-0x0000000000416000-memory.dmp
memory/1952-28-0x0000000000400000-0x0000000000416000-memory.dmp
memory/2732-34-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3208-16-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3412-0-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3412-5-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3876-10-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3876-6-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3968-63-0x0000000000400000-0x0000000000416000-memory.dmp
memory/3976-39-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5156-52-0x0000000000400000-0x0000000000416000-memory.dmp
memory/5432-58-0x0000000000400000-0x0000000000416000-memory.dmp
memory/6024-22-0x0000000000400000-0x0000000000416000-memory.dmp