Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 15:56
General
- Target 2026-06-04_79487a433bd39d0b0e6317e554fa823e_elex_wannacry.exe
- Size 64KB
- Sample260604-tdtymsat6s
- SHA256 48556f82511d8e97d2b1a8e6b18ab6f942b4edbb05b4473f568291e33508e53a
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_79487a433bd39d0b0e6317e554fa823e_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_79487a433bd39d0b0e6317e554fa823e_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30621C18-9CA0-4597-8FBB-091692711D39}.exeC:\Windows\{30621C18-9CA0-4597-8FBB-091692711D39}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{10291037-B252-476c-9D2A-F2E05ACE146B}.exeC:\Windows\{10291037-B252-476c-9D2A-F2E05ACE146B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BC4DF88B-F436-4061-9B2C-9E5E83E3D676}.exeC:\Windows\{BC4DF88B-F436-4061-9B2C-9E5E83E3D676}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7171804F-740F-4b5a-A51C-DEFABB2373A8}.exeC:\Windows\{7171804F-740F-4b5a-A51C-DEFABB2373A8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C5656E6-9F08-49e1-80D5-CFA3897FB7E5}.exeC:\Windows\{6C5656E6-9F08-49e1-80D5-CFA3897FB7E5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{507D80B3-1E63-478e-8786-7F8565758529}.exeC:\Windows\{507D80B3-1E63-478e-8786-7F8565758529}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D55D3BA8-A73D-44a3-AF55-284A187524EF}.exeC:\Windows\{D55D3BA8-A73D-44a3-AF55-284A187524EF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{105AD8B4-C162-4adb-8FF3-2A7B0DA571E3}.exeC:\Windows\{105AD8B4-C162-4adb-8FF3-2A7B0DA571E3}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FE2058E-70BD-4bd6-8B87-A5BD09164AD6}.exeC:\Windows\{8FE2058E-70BD-4bd6-8B87-A5BD09164AD6}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74E4E909-D89E-4640-A00B-0562FF2B6C9D}.exeC:\Windows\{74E4E909-D89E-4640-A00B-0562FF2B6C9D}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6FB54556-1F1B-492d-BBC9-877F761B5B41}.exeC:\Windows\{6FB54556-1F1B-492d-BBC9-877F761B5B41}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74E4E~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8FE20~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{105AD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D55D3~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{507D8~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C565~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{71718~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BC4DF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{10291~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30621~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{10291037-B252-476c-9D2A-F2E05ACE146B}.exe
{105AD8B4-C162-4adb-8FF3-2A7B0DA571E3}.exe
{30621C18-9CA0-4597-8FBB-091692711D39}.exe
{507D80B3-1E63-478e-8786-7F8565758529}.exe
{6C5656E6-9F08-49e1-80D5-CFA3897FB7E5}.exe
{6FB54556-1F1B-492d-BBC9-877F761B5B41}.exe
{7171804F-740F-4b5a-A51C-DEFABB2373A8}.exe
{74E4E909-D89E-4640-A00B-0562FF2B6C9D}.exe
{8FE2058E-70BD-4bd6-8B87-A5BD09164AD6}.exe
{BC4DF88B-F436-4061-9B2C-9E5E83E3D676}.exe
{D55D3BA8-A73D-44a3-AF55-284A187524EF}.exe