Analysis
- max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
09/06/2026, 16:59
General
- Target 2026-06-09_710a2d4c424b5f482a3f12b5ca45d6eb_elex_wannacry.exe
- Size 92KB
- Sample260609-vhh8daev3y
- SHA256 3519040ac65cc2c1c0eff66974bd8ae5e008e564ded2f2f3fe587472571ff170
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 27 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-09_710a2d4c424b5f482a3f12b5ca45d6eb_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-09_710a2d4c424b5f482a3f12b5ca45d6eb_elex_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0421AB0D-E9E7-4429-BAC2-AA20EB8953C7}.exeC:\Windows\{0421AB0D-E9E7-4429-BAC2-AA20EB8953C7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AFA2EB8C-063E-41f6-A49B-7C3534275664}.exeC:\Windows\{AFA2EB8C-063E-41f6-A49B-7C3534275664}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E09071EB-D5C8-410a-91FF-B9D0B413A002}.exeC:\Windows\{E09071EB-D5C8-410a-91FF-B9D0B413A002}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB99471C-CCC6-4bf3-AE8D-883A85FC2237}.exeC:\Windows\{FB99471C-CCC6-4bf3-AE8D-883A85FC2237}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{72D69F5E-13BC-424b-B417-937BCCFBA0A2}.exeC:\Windows\{72D69F5E-13BC-424b-B417-937BCCFBA0A2}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2B932A9B-72A2-42da-A29E-E85F86C31327}.exeC:\Windows\{2B932A9B-72A2-42da-A29E-E85F86C31327}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1FA7362B-CF6D-4a80-B208-988206D7AEFE}.exeC:\Windows\{1FA7362B-CF6D-4a80-B208-988206D7AEFE}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F9DEAFC-C502-4f9c-AAA2-56CDC2133C91}.exeC:\Windows\{1F9DEAFC-C502-4f9c-AAA2-56CDC2133C91}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4020AE62-E104-4e9a-8149-D648F5F7889E}.exeC:\Windows\{4020AE62-E104-4e9a-8149-D648F5F7889E}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4E0B6076-A431-4d25-9E1B-9BED689837ED}.exeC:\Windows\{4E0B6076-A431-4d25-9E1B-9BED689837ED}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4020A~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F9DE~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1FA73~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2B932~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{72D69~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB994~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0907~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AFA2E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0421A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0421AB0D-E9E7-4429-BAC2-AA20EB8953C7}.exe
{1F9DEAFC-C502-4f9c-AAA2-56CDC2133C91}.exe
{1FA7362B-CF6D-4a80-B208-988206D7AEFE}.exe
{2B932A9B-72A2-42da-A29E-E85F86C31327}.exe
{4020AE62-E104-4e9a-8149-D648F5F7889E}.exe
{4E0B6076-A431-4d25-9E1B-9BED689837ED}.exe
{72D69F5E-13BC-424b-B417-937BCCFBA0A2}.exe
{AFA2EB8C-063E-41f6-A49B-7C3534275664}.exe
{E09071EB-D5C8-410a-91FF-B9D0B413A002}.exe
{FB99471C-CCC6-4bf3-AE8D-883A85FC2237}.exe
memory/1352-40-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2388-28-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2388-24-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2552-56-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2784-35-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2784-30-0x0000000000400000-0x0000000000417000-memory.dmp
memory/2976-50-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3312-12-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3312-8-0x0000000000400000-0x0000000000417000-memory.dmp
memory/3312-5-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4436-45-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4632-18-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4632-14-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4772-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4772-6-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4772-1-0x0000000000400000-0x0000000000417000-memory.dmp
memory/4928-23-0x0000000000400000-0x0000000000417000-memory.dmp