Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
19/04/2026, 15:10
General
- Target 2026-04-19_499d38e8c4ea88111ccbaef49c6b5706_elex_goldeneye_wannacry.exe
- Size 344KB
- Sample260419-skbvzaay21
- SHA256 1cc51dd859ef091db21a4cb6ee1e68ea40465866f69afede18cf0829b9d8ed36
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureAuto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_499d38e8c4ea88111ccbaef49c6b5706_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_499d38e8c4ea88111ccbaef49c6b5706_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50BA7D89-B5F2-4955-8EB5-1F6CEEA4A37E}.exeC:\Windows\{50BA7D89-B5F2-4955-8EB5-1F6CEEA4A37E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6610E9B-9DE6-48ba-9BF0-C768E618DC57}.exeC:\Windows\{D6610E9B-9DE6-48ba-9BF0-C768E618DC57}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{020DD2C6-EFD8-46e5-AD71-6BCAA2FD4A95}.exeC:\Windows\{020DD2C6-EFD8-46e5-AD71-6BCAA2FD4A95}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7DBCAA98-DA0A-479f-9959-E05BCD86D8D6}.exeC:\Windows\{7DBCAA98-DA0A-479f-9959-E05BCD86D8D6}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{90FB56BE-7393-412c-8B28-2199C09ABEAF}.exeC:\Windows\{90FB56BE-7393-412c-8B28-2199C09ABEAF}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E1C1E915-91ED-48a9-AAEA-3947B6975278}.exeC:\Windows\{E1C1E915-91ED-48a9-AAEA-3947B6975278}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7B2021AE-E265-4991-A5B9-D4C6DFBD7040}.exeC:\Windows\{7B2021AE-E265-4991-A5B9-D4C6DFBD7040}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{63459AA7-F2C1-4d57-B35F-1DBBD2DF300B}.exeC:\Windows\{63459AA7-F2C1-4d57-B35F-1DBBD2DF300B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F45EC5EF-4D34-42c8-AB44-5DD7DBECAF70}.exeC:\Windows\{F45EC5EF-4D34-42c8-AB44-5DD7DBECAF70}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{60A5571D-5F9A-4e62-9553-B4715E2A93DB}.exeC:\Windows\{60A5571D-5F9A-4e62-9553-B4715E2A93DB}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBD6D944-2D5B-4c87-8467-5E86D28BE228}.exeC:\Windows\{BBD6D944-2D5B-4c87-8467-5E86D28BE228}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{60A55~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F45EC~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{63459~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7B202~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E1C1E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90FB5~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7DBCA~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{020DD~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6610~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50BA7~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{020DD2C6-EFD8-46e5-AD71-6BCAA2FD4A95}.exe
{50BA7D89-B5F2-4955-8EB5-1F6CEEA4A37E}.exe
{60A5571D-5F9A-4e62-9553-B4715E2A93DB}.exe
{63459AA7-F2C1-4d57-B35F-1DBBD2DF300B}.exe
{7B2021AE-E265-4991-A5B9-D4C6DFBD7040}.exe
{7DBCAA98-DA0A-479f-9959-E05BCD86D8D6}.exe
{90FB56BE-7393-412c-8B28-2199C09ABEAF}.exe
{BBD6D944-2D5B-4c87-8467-5E86D28BE228}.exe
{D6610E9B-9DE6-48ba-9BF0-C768E618DC57}.exe
{E1C1E915-91ED-48a9-AAEA-3947B6975278}.exe
{F45EC5EF-4D34-42c8-AB44-5DD7DBECAF70}.exe
memory/220-36-0x0000000000920000-0x000000000099A000-memory.dmp
memory/1732-48-0x0000000000780000-0x00000000007FA000-memory.dmp
memory/2140-24-0x0000000000480000-0x00000000004FA000-memory.dmp
memory/2764-12-0x00000000008D0000-0x000000000094A000-memory.dmp
memory/3112-18-0x00000000007E0000-0x000000000085A000-memory.dmp
memory/3788-42-0x0000000000660000-0x00000000006DA000-memory.dmp
memory/4144-54-0x00000000005B0000-0x000000000062A000-memory.dmp
memory/4448-0-0x00000000008A0000-0x000000000091A000-memory.dmp
memory/4576-6-0x0000000000570000-0x00000000005EA000-memory.dmp
memory/4640-30-0x0000000000760000-0x00000000007DA000-memory.dmp
memory/4960-60-0x0000000000480000-0x00000000004FA000-memory.dmp