Analysis
- max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 17:07
General
- Target 2026-04-17_840918185a41da277a4952a82f8f5a84_elex_goldeneye_wannacry.exe
- Size 380KB
- Sample260417-vm1yzsgz4t
- SHA256 f7684dd9e342b63322716405fe25d53bbba550735a11d5897618d585a037c872
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Custom signatureAuto-generated rule 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-17_840918185a41da277a4952a82f8f5a84_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-17_840918185a41da277a4952a82f8f5a84_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80ABB901-D132-43a0-9D76-2178A3306D4B}.exeC:\Windows\{80ABB901-D132-43a0-9D76-2178A3306D4B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{527874B2-9237-468e-97BA-B5D1DAFA4319}.exeC:\Windows\{527874B2-9237-468e-97BA-B5D1DAFA4319}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{21871470-6A9F-4d3d-9A62-4A715A632801}.exeC:\Windows\{21871470-6A9F-4d3d-9A62-4A715A632801}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5D9A464F-DDD1-4df5-8B61-E3158DDE7483}.exeC:\Windows\{5D9A464F-DDD1-4df5-8B61-E3158DDE7483}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CE0E5FCB-41B4-448c-BD77-85885649B99F}.exeC:\Windows\{CE0E5FCB-41B4-448c-BD77-85885649B99F}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2BE0590C-52DD-4e5a-9E98-82E61482D874}.exeC:\Windows\{2BE0590C-52DD-4e5a-9E98-82E61482D874}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DC0B2567-A05D-4bdd-9C91-C6557BFA17CF}.exeC:\Windows\{DC0B2567-A05D-4bdd-9C91-C6557BFA17CF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DFB3A948-CACD-4b7c-AF1F-939A167C22F7}.exeC:\Windows\{DFB3A948-CACD-4b7c-AF1F-939A167C22F7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78C47A6D-E1C2-4623-9F62-56BACFE44C7D}.exeC:\Windows\{78C47A6D-E1C2-4623-9F62-56BACFE44C7D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{09F65696-984C-4451-9D5A-8E4426FAAB45}.exeC:\Windows\{09F65696-984C-4451-9D5A-8E4426FAAB45}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78C47~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DFB3A~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DC0B2~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BE05~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CE0E5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D9A4~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{21871~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52787~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80ABB~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{09F65696-984C-4451-9D5A-8E4426FAAB45}.exe
{21871470-6A9F-4d3d-9A62-4A715A632801}.exe
{2BE0590C-52DD-4e5a-9E98-82E61482D874}.exe
{527874B2-9237-468e-97BA-B5D1DAFA4319}.exe
{5D9A464F-DDD1-4df5-8B61-E3158DDE7483}.exe
{78C47A6D-E1C2-4623-9F62-56BACFE44C7D}.exe
{80ABB901-D132-43a0-9D76-2178A3306D4B}.exe
{CE0E5FCB-41B4-448c-BD77-85885649B99F}.exe
{DC0B2567-A05D-4bdd-9C91-C6557BFA17CF}.exe
{DFB3A948-CACD-4b7c-AF1F-939A167C22F7}.exe