Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/06/2026, 04:33
General
- Target 2026-06-04_99c5c7f37eb4c4661d5a0727fbbf108a_elex_wannacry.exe
- Size 90KB
- Sample260604-e6t2saa12l
- SHA256 bf6261582f9d7cec4482484d25ffce191439746e33a3dc37ea58a5bdb8beae4a
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_99c5c7f37eb4c4661d5a0727fbbf108a_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_99c5c7f37eb4c4661d5a0727fbbf108a_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{52C4BD3E-71C1-4ca0-8D06-1555C564C04F}.exeC:\Windows\{52C4BD3E-71C1-4ca0-8D06-1555C564C04F}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CABCDA87-E7EA-41cb-8286-74FD08EAB3B2}.exeC:\Windows\{CABCDA87-E7EA-41cb-8286-74FD08EAB3B2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{84F958D5-E25C-4e93-B6F3-F8A3F082DC01}.exeC:\Windows\{84F958D5-E25C-4e93-B6F3-F8A3F082DC01}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{136A7CAD-1669-4085-8009-0A0A1A526427}.exeC:\Windows\{136A7CAD-1669-4085-8009-0A0A1A526427}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03C75CFB-5E8B-48b2-BD1A-4210FB3827B6}.exeC:\Windows\{03C75CFB-5E8B-48b2-BD1A-4210FB3827B6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15AD9DB4-2272-434c-9B65-5B1581912EFF}.exeC:\Windows\{15AD9DB4-2272-434c-9B65-5B1581912EFF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{64D74241-6D0E-45cc-B029-3C4789B53903}.exeC:\Windows\{64D74241-6D0E-45cc-B029-3C4789B53903}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4AFF602B-1FF7-42a6-85E8-54B11E04F721}.exeC:\Windows\{4AFF602B-1FF7-42a6-85E8-54B11E04F721}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8F6FE8B-F047-446c-B924-F1C42011159D}.exeC:\Windows\{A8F6FE8B-F047-446c-B924-F1C42011159D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B93DEAA2-2662-4f65-9CA7-0F41F33016FE}.exeC:\Windows\{B93DEAA2-2662-4f65-9CA7-0F41F33016FE}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B20EDF4D-36BB-409c-A5C1-36619F0D99FE}.exeC:\Windows\{B20EDF4D-36BB-409c-A5C1-36619F0D99FE}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B93DE~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8F6F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AFF6~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{64D74~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15AD9~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03C75~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{136A7~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{84F95~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CABCD~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52C4B~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{03C75CFB-5E8B-48b2-BD1A-4210FB3827B6}.exe
{136A7CAD-1669-4085-8009-0A0A1A526427}.exe
{15AD9DB4-2272-434c-9B65-5B1581912EFF}.exe
{4AFF602B-1FF7-42a6-85E8-54B11E04F721}.exe
{52C4BD3E-71C1-4ca0-8D06-1555C564C04F}.exe
{64D74241-6D0E-45cc-B029-3C4789B53903}.exe
{84F958D5-E25C-4e93-B6F3-F8A3F082DC01}.exe
{A8F6FE8B-F047-446c-B924-F1C42011159D}.exe
{B20EDF4D-36BB-409c-A5C1-36619F0D99FE}.exe
{B93DEAA2-2662-4f65-9CA7-0F41F33016FE}.exe
{CABCDA87-E7EA-41cb-8286-74FD08EAB3B2}.exe