Analysis
- max time kernel
149s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
04/06/2026, 18:47
General
- Target 2026-06-04_3434dafd469238ad0843339aae5a826d_elex_wannacry.exe
- Size 64KB
- Sample260604-xffetacv2y
- SHA256 22d7c1419a8e6c2aa960c2f58ace7938570284cf57a487a7e407371c2c4901d0
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 31 IoCs
- Detects Windows executables referencing non-Windows User-Agents 31 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_3434dafd469238ad0843339aae5a826d_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_3434dafd469238ad0843339aae5a826d_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7F9D59B9-9291-448f-B378-51057A809F00}.exeC:\Windows\{7F9D59B9-9291-448f-B378-51057A809F00}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{622F9F65-75BC-4433-AF44-A060F0131AC5}.exeC:\Windows\{622F9F65-75BC-4433-AF44-A060F0131AC5}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E393EB42-01E6-4701-BECF-ED909C95A63B}.exeC:\Windows\{E393EB42-01E6-4701-BECF-ED909C95A63B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A2211AAB-F213-435b-8BF1-BE326009C448}.exeC:\Windows\{A2211AAB-F213-435b-8BF1-BE326009C448}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{05CA9927-F6B5-4832-AB86-EB9460015409}.exeC:\Windows\{05CA9927-F6B5-4832-AB86-EB9460015409}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D5BB0D5-4152-4b46-AA78-CA45104ED151}.exeC:\Windows\{1D5BB0D5-4152-4b46-AA78-CA45104ED151}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{610B57C8-4B5E-40db-A26F-D7B6B93C4919}.exeC:\Windows\{610B57C8-4B5E-40db-A26F-D7B6B93C4919}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{61EBB227-94B1-46a4-AE0D-B92E770362A6}.exeC:\Windows\{61EBB227-94B1-46a4-AE0D-B92E770362A6}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B51F756C-791F-41d6-AFC2-55C7CC628C5B}.exeC:\Windows\{B51F756C-791F-41d6-AFC2-55C7CC628C5B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA3B869B-2D1E-405f-9798-0426EAA21A2A}.exeC:\Windows\{AA3B869B-2D1E-405f-9798-0426EAA21A2A}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B51F7~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{61EBB~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{610B5~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D5BB~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{05CA9~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A2211~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E393E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{622F9~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7F9D5~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{05CA9927-F6B5-4832-AB86-EB9460015409}.exe
{1D5BB0D5-4152-4b46-AA78-CA45104ED151}.exe
{610B57C8-4B5E-40db-A26F-D7B6B93C4919}.exe
{61EBB227-94B1-46a4-AE0D-B92E770362A6}.exe
{622F9F65-75BC-4433-AF44-A060F0131AC5}.exe
{7F9D59B9-9291-448f-B378-51057A809F00}.exe
{A2211AAB-F213-435b-8BF1-BE326009C448}.exe
{AA3B869B-2D1E-405f-9798-0426EAA21A2A}.exe
{B51F756C-791F-41d6-AFC2-55C7CC628C5B}.exe
{E393EB42-01E6-4701-BECF-ED909C95A63B}.exe
memory/1104-48-0x0000000000400000-0x0000000000410000-memory.dmp
memory/1104-52-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2728-7-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2728-0-0x0000000000400000-0x0000000000410000-memory.dmp
memory/2728-1-0x0000000000400000-0x0000000000410000-memory.dmp
memory/3216-60-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4108-24-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4108-19-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4260-36-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4260-31-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4416-12-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4416-8-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4416-5-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4700-58-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4700-54-0x0000000000400000-0x0000000000410000-memory.dmp
memory/4964-28-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5524-46-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5572-18-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5572-14-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5932-41-0x0000000000400000-0x0000000000410000-memory.dmp
memory/5932-35-0x0000000000400000-0x0000000000410000-memory.dmp