Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
18/04/2026, 17:55
General
- Target 2026-04-18_70466c1fa75e4ce7c52eddd04779ebe8_elex_goldeneye_wannacry.exe
- Size 408KB
- Sample260418-whythadz4m
- SHA256 adae45f970bba67aed7fc5ff9468f2e1a5c3bc09e878a086f24f58dda6e255d9
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-18_70466c1fa75e4ce7c52eddd04779ebe8_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-18_70466c1fa75e4ce7c52eddd04779ebe8_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FF4915AB-07FF-4735-AE20-A72D5908E1F5}.exeC:\Windows\{FF4915AB-07FF-4735-AE20-A72D5908E1F5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D0D78A90-5570-4dbb-8974-1E5C5B0F43D9}.exeC:\Windows\{D0D78A90-5570-4dbb-8974-1E5C5B0F43D9}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA03660B-AFF2-4b98-BC8E-CF9B2EEC73A2}.exeC:\Windows\{DA03660B-AFF2-4b98-BC8E-CF9B2EEC73A2}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B715868B-5892-4fb8-98FA-5292BD65DB63}.exeC:\Windows\{B715868B-5892-4fb8-98FA-5292BD65DB63}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B4FDDB79-61C8-4648-B8F6-799F92BFDFA3}.exeC:\Windows\{B4FDDB79-61C8-4648-B8F6-799F92BFDFA3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{786ED23D-6FD7-4235-805F-F1EE5D556A54}.exeC:\Windows\{786ED23D-6FD7-4235-805F-F1EE5D556A54}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B347EA3-DDBE-421c-9674-67CCCCD5A9F6}.exeC:\Windows\{9B347EA3-DDBE-421c-9674-67CCCCD5A9F6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FAEE3D6A-EAF7-4e1a-8F9E-2040517C08D7}.exeC:\Windows\{FAEE3D6A-EAF7-4e1a-8F9E-2040517C08D7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBEC6B9F-F4E2-4a4b-9F33-28BB62B6207C}.exeC:\Windows\{BBEC6B9F-F4E2-4a4b-9F33-28BB62B6207C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD5AC4F6-0C37-4f6a-AA0F-9DA612FAA116}.exeC:\Windows\{BD5AC4F6-0C37-4f6a-AA0F-9DA612FAA116}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A24512BD-BE64-41f6-9282-CF22E9369369}.exeC:\Windows\{A24512BD-BE64-41f6-9282-CF22E9369369}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD5AC~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBEC6~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAEE3~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B347~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{786ED~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B4FDD~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B7158~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DA036~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D0D78~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FF491~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{786ED23D-6FD7-4235-805F-F1EE5D556A54}.exe
{9B347EA3-DDBE-421c-9674-67CCCCD5A9F6}.exe
{A24512BD-BE64-41f6-9282-CF22E9369369}.exe
{B4FDDB79-61C8-4648-B8F6-799F92BFDFA3}.exe
{B715868B-5892-4fb8-98FA-5292BD65DB63}.exe
{BBEC6B9F-F4E2-4a4b-9F33-28BB62B6207C}.exe
{BD5AC4F6-0C37-4f6a-AA0F-9DA612FAA116}.exe
{D0D78A90-5570-4dbb-8974-1E5C5B0F43D9}.exe
{DA03660B-AFF2-4b98-BC8E-CF9B2EEC73A2}.exe
{FAEE3D6A-EAF7-4e1a-8F9E-2040517C08D7}.exe
{FF4915AB-07FF-4735-AE20-A72D5908E1F5}.exe