Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
19/04/2026, 16:25
General
- Target 2026-04-19_0a8d9a58ce9c2bcaefec7dec69fcf70c_elex_goldeneye_wannacry.exe
- Size 408KB
- Sample260419-txd2jaby81
- SHA256 397617ac0bd7f2ca6255c0e4d44486aa45bebb87507a68a13eeadf3e58ba349b
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureAuto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-19_0a8d9a58ce9c2bcaefec7dec69fcf70c_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-19_0a8d9a58ce9c2bcaefec7dec69fcf70c_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{873F9149-DFF8-4477-B318-2458E963D09A}.exeC:\Windows\{873F9149-DFF8-4477-B318-2458E963D09A}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{11CCEAE9-0D8E-429e-8428-F1D4A878EFDF}.exeC:\Windows\{11CCEAE9-0D8E-429e-8428-F1D4A878EFDF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0F520AC9-533D-426a-9E9A-69623242F294}.exeC:\Windows\{0F520AC9-533D-426a-9E9A-69623242F294}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED87B490-5ED6-41a5-9221-1D1DEE530544}.exeC:\Windows\{ED87B490-5ED6-41a5-9221-1D1DEE530544}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{233497AB-10FC-4b07-BD84-A9906CFF0C60}.exeC:\Windows\{233497AB-10FC-4b07-BD84-A9906CFF0C60}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9509B8C8-9FD7-40d7-9822-F0688A3677AA}.exeC:\Windows\{9509B8C8-9FD7-40d7-9822-F0688A3677AA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8C7CE482-9F0C-4aa1-ACED-9024B05CF701}.exeC:\Windows\{8C7CE482-9F0C-4aa1-ACED-9024B05CF701}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B846FCF-A08A-418c-B1BA-16E39E5AB9B4}.exeC:\Windows\{3B846FCF-A08A-418c-B1BA-16E39E5AB9B4}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81A4B4FF-8833-40ce-98FE-F4630879D74C}.exeC:\Windows\{81A4B4FF-8833-40ce-98FE-F4630879D74C}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{031876EC-2287-40e2-A65F-B313F5A0EBA3}.exeC:\Windows\{031876EC-2287-40e2-A65F-B313F5A0EBA3}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3D9CA559-AE73-442e-A4FE-4AA758E5D949}.exeC:\Windows\{3D9CA559-AE73-442e-A4FE-4AA758E5D949}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03187~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81A4B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B846~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C7CE~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9509B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23349~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED87B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0F520~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{11CCE~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{873F9~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{031876EC-2287-40e2-A65F-B313F5A0EBA3}.exe
{0F520AC9-533D-426a-9E9A-69623242F294}.exe
{11CCEAE9-0D8E-429e-8428-F1D4A878EFDF}.exe
{233497AB-10FC-4b07-BD84-A9906CFF0C60}.exe
{3B846FCF-A08A-418c-B1BA-16E39E5AB9B4}.exe
{3D9CA559-AE73-442e-A4FE-4AA758E5D949}.exe
{81A4B4FF-8833-40ce-98FE-F4630879D74C}.exe
{873F9149-DFF8-4477-B318-2458E963D09A}.exe
{8C7CE482-9F0C-4aa1-ACED-9024B05CF701}.exe
{9509B8C8-9FD7-40d7-9822-F0688A3677AA}.exe
{ED87B490-5ED6-41a5-9221-1D1DEE530544}.exe