Analysis
- max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 16:50
General
- Target 2026-04-24_2bd7fdbc3755a17f15e01c7d3b09ad52_elex_goldeneye_wannacry.exe
- Size 468KB
- Sample260424-vb8jpaft2m
- SHA256 11043d6e207fba7fcefeba4ddd378bc0ea61412033f4651382927df080789c62
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Auto-generated rule 10 IoCs
- Detects Windows executables referencing Office macro registry keys. Observed modifying Office config 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_2bd7fdbc3755a17f15e01c7d3b09ad52_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_2bd7fdbc3755a17f15e01c7d3b09ad52_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51041890-10AB-4a43-A346-EF56209BA406}.exeC:\Windows\{51041890-10AB-4a43-A346-EF56209BA406}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{78EA2A7B-998D-4a9d-A113-6EADBEAD69FC}.exeC:\Windows\{78EA2A7B-998D-4a9d-A113-6EADBEAD69FC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EF4F494E-A5BC-462e-8704-79E8025DD0A5}.exeC:\Windows\{EF4F494E-A5BC-462e-8704-79E8025DD0A5}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5BF68F2-DB2C-438c-92FF-F79ED1210281}.exeC:\Windows\{A5BF68F2-DB2C-438c-92FF-F79ED1210281}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6691C25-8049-4205-9361-750316652806}.exeC:\Windows\{C6691C25-8049-4205-9361-750316652806}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A189E780-2BCA-4937-BF0E-F7A716A90EC7}.exeC:\Windows\{A189E780-2BCA-4937-BF0E-F7A716A90EC7}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BE308E60-47A2-46e7-A9FB-E54BDD3DA4F7}.exeC:\Windows\{BE308E60-47A2-46e7-A9FB-E54BDD3DA4F7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7BA82A5-45FD-4fa9-8AF8-7D92D3A442B4}.exeC:\Windows\{E7BA82A5-45FD-4fa9-8AF8-7D92D3A442B4}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CFCC28FE-9349-4986-AE19-11A3CD46F371}.exeC:\Windows\{CFCC28FE-9349-4986-AE19-11A3CD46F371}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DA6CB1EC-C484-4e49-8FD8-A3CCD5B24ECD}.exeC:\Windows\{DA6CB1EC-C484-4e49-8FD8-A3CCD5B24ECD}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CFCC2~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7BA8~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BE308~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A189E~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6691~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5BF6~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EF4F4~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{78EA2~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51041~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{51041890-10AB-4a43-A346-EF56209BA406}.exe
{78EA2A7B-998D-4a9d-A113-6EADBEAD69FC}.exe
{A189E780-2BCA-4937-BF0E-F7A716A90EC7}.exe
{A5BF68F2-DB2C-438c-92FF-F79ED1210281}.exe
{BE308E60-47A2-46e7-A9FB-E54BDD3DA4F7}.exe
{C6691C25-8049-4205-9361-750316652806}.exe
{CFCC28FE-9349-4986-AE19-11A3CD46F371}.exe
{DA6CB1EC-C484-4e49-8FD8-A3CCD5B24ECD}.exe
{E7BA82A5-45FD-4fa9-8AF8-7D92D3A442B4}.exe
{EF4F494E-A5BC-462e-8704-79E8025DD0A5}.exe
memory/1020-18-0x0000000000890000-0x000000000096F000-memory.dmp
memory/1020-22-0x0000000000890000-0x000000000096F000-memory.dmp
memory/1180-28-0x0000000000840000-0x000000000091F000-memory.dmp
memory/1180-24-0x0000000000840000-0x000000000091F000-memory.dmp
memory/1376-52-0x0000000000870000-0x000000000094F000-memory.dmp
memory/1376-48-0x0000000000870000-0x000000000094F000-memory.dmp
memory/1872-30-0x0000000000870000-0x000000000094F000-memory.dmp
memory/1872-34-0x0000000000870000-0x000000000094F000-memory.dmp
memory/2032-42-0x0000000000850000-0x000000000092F000-memory.dmp
memory/2032-47-0x0000000000850000-0x000000000092F000-memory.dmp
memory/2176-40-0x0000000000860000-0x000000000093F000-memory.dmp
memory/2176-36-0x0000000000860000-0x000000000093F000-memory.dmp
memory/4392-12-0x0000000000890000-0x000000000096F000-memory.dmp
memory/4392-15-0x0000000000890000-0x000000000096F000-memory.dmp
memory/4460-54-0x0000000000870000-0x000000000094F000-memory.dmp
memory/4460-58-0x0000000000870000-0x000000000094F000-memory.dmp
memory/4916-11-0x0000000000870000-0x000000000094F000-memory.dmp
memory/4916-6-0x0000000000870000-0x000000000094F000-memory.dmp
memory/5048-0-0x00000000009A0000-0x0000000000A7F000-memory.dmp
memory/5048-5-0x00000000009A0000-0x0000000000A7F000-memory.dmp