Analysis
- max time kernel
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
09/06/2026, 03:45
General
- Target 2026-06-09_8d4d892dabe21b4507fe91d52bbac2f2_elex_wannacry.exe
- Size 89KB
- Sample260609-ebjmkabv6x
- SHA256 1c1e503a3c6844eb03851a6e874197e792257570a41a0690d0f90e95fa7059e7
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 27 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-09_8d4d892dabe21b4507fe91d52bbac2f2_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-09_8d4d892dabe21b4507fe91d52bbac2f2_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{04B72032-320F-4273-9AFF-C9FB002F20B3}.exeC:\Windows\{04B72032-320F-4273-9AFF-C9FB002F20B3}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BEE27F7-4969-4e25-BD97-9B2401242B77}.exeC:\Windows\{9BEE27F7-4969-4e25-BD97-9B2401242B77}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{30F40493-667B-4863-B0F8-FBFC4F9BE072}.exeC:\Windows\{30F40493-667B-4863-B0F8-FBFC4F9BE072}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F49111EB-1C32-4168-A3F7-C3E6F3DBAE9D}.exeC:\Windows\{F49111EB-1C32-4168-A3F7-C3E6F3DBAE9D}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4926B5D8-D814-443f-A48B-FAE164E88878}.exeC:\Windows\{4926B5D8-D814-443f-A48B-FAE164E88878}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0A0A4A6E-EB2E-4fce-97D3-2143A669EFAD}.exeC:\Windows\{0A0A4A6E-EB2E-4fce-97D3-2143A669EFAD}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B37BD6DB-290E-4b0f-A207-F5D552BAE692}.exeC:\Windows\{B37BD6DB-290E-4b0f-A207-F5D552BAE692}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5C4D3A1B-3756-4701-A0AE-C0F0AF86151A}.exeC:\Windows\{5C4D3A1B-3756-4701-A0AE-C0F0AF86151A}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49DD6E04-00FD-4723-8A98-E2284EF39350}.exeC:\Windows\{49DD6E04-00FD-4723-8A98-E2284EF39350}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5C4D3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B37BD~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0A0A4~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4926B~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F4911~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{30F40~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BEE2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{04B72~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{04B72032-320F-4273-9AFF-C9FB002F20B3}.exe
{0A0A4A6E-EB2E-4fce-97D3-2143A669EFAD}.exe
{30F40493-667B-4863-B0F8-FBFC4F9BE072}.exe
{4926B5D8-D814-443f-A48B-FAE164E88878}.exe
{49DD6E04-00FD-4723-8A98-E2284EF39350}.exe
{5C4D3A1B-3756-4701-A0AE-C0F0AF86151A}.exe
{9BEE27F7-4969-4e25-BD97-9B2401242B77}.exe
{B37BD6DB-290E-4b0f-A207-F5D552BAE692}.exe
{F49111EB-1C32-4168-A3F7-C3E6F3DBAE9D}.exe
memory/652-16-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2036-31-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2036-35-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2440-47-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2440-52-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2640-0-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2640-1-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2640-7-0x0000000000400000-0x0000000000411000-memory.dmp
memory/2928-46-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3900-22-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3900-18-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3976-25-0x0000000000400000-0x0000000000411000-memory.dmp
memory/3976-29-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4052-41-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4052-37-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4144-5-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4144-8-0x0000000000400000-0x0000000000411000-memory.dmp
memory/4144-12-0x0000000000400000-0x0000000000411000-memory.dmp