Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 04:20
General
- Target 2026-06-04_8c8a308473f18457bc981a7c9a4704e8_elex_wannacry.exe
- Size 92KB
- Sample260604-ex3ybsaz2n
- SHA256 b770eddec839555fa5a88526ed94d041922166897c0b9780eb26e6b53e38043f
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 30 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_8c8a308473f18457bc981a7c9a4704e8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_8c8a308473f18457bc981a7c9a4704e8_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CA13B4C7-2F27-4ab2-A2B9-6905BF59EAB3}.exeC:\Windows\{CA13B4C7-2F27-4ab2-A2B9-6905BF59EAB3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{829DB53E-1414-40c0-824C-91E298381258}.exeC:\Windows\{829DB53E-1414-40c0-824C-91E298381258}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D9AFBFC5-5F0E-4895-9028-AB1093491E30}.exeC:\Windows\{D9AFBFC5-5F0E-4895-9028-AB1093491E30}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{651D6D4D-7368-4309-AFDC-DAD1A91652F0}.exeC:\Windows\{651D6D4D-7368-4309-AFDC-DAD1A91652F0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17D6E004-A434-454e-8CC0-B81D8EFEB412}.exeC:\Windows\{17D6E004-A434-454e-8CC0-B81D8EFEB412}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6619E70-685F-4d18-BDFA-9E380CD5FC21}.exeC:\Windows\{F6619E70-685F-4d18-BDFA-9E380CD5FC21}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E918FE9B-72CD-4e9d-9912-6977EFCB21D3}.exeC:\Windows\{E918FE9B-72CD-4e9d-9912-6977EFCB21D3}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7E1F730-FF1E-4077-8CCF-C669BC805CE5}.exeC:\Windows\{A7E1F730-FF1E-4077-8CCF-C669BC805CE5}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8961FD29-DFD9-445e-8B1D-C9E818B4D8DE}.exeC:\Windows\{8961FD29-DFD9-445e-8B1D-C9E818B4D8DE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{563D1A59-56E0-4dcd-B407-D94DB71BDB68}.exeC:\Windows\{563D1A59-56E0-4dcd-B407-D94DB71BDB68}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8961F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7E1F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E918F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6619~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17D6E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{651D6~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D9AFB~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{829DB~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CA13B~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{17D6E004-A434-454e-8CC0-B81D8EFEB412}.exe
{563D1A59-56E0-4dcd-B407-D94DB71BDB68}.exe
{651D6D4D-7368-4309-AFDC-DAD1A91652F0}.exe
{829DB53E-1414-40c0-824C-91E298381258}.exe
{8961FD29-DFD9-445e-8B1D-C9E818B4D8DE}.exe
{A7E1F730-FF1E-4077-8CCF-C669BC805CE5}.exe
{CA13B4C7-2F27-4ab2-A2B9-6905BF59EAB3}.exe
{D9AFBFC5-5F0E-4895-9028-AB1093491E30}.exe
{E918FE9B-72CD-4e9d-9912-6977EFCB21D3}.exe
{F6619E70-685F-4d18-BDFA-9E380CD5FC21}.exe
memory/656-35-0x0000000000400000-0x0000000000417000-memory.dmp
memory/656-32-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1060-5-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1060-12-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1060-8-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1468-26-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1468-30-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1936-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1936-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/1936-6-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2212-59-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2224-41-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2224-37-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2392-13-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2392-17-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2520-20-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2520-23-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3752-48-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3752-52-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3788-47-0x0000000000400000-0x0000000000417000-memory.dmp