Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
24/04/2026, 16:59
General
- Target 2026-04-24_708cf53b23e670649a1256c920a12bf1_elex_goldeneye_wannacry.exe
- Size 468KB
- Sample260424-vhsrtafv6l
- SHA256 2ae7fddd190822a71def72804450a34bd149754b27c28488d7114ca0a0e2b68d
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Custom signatureAuto-generated rule 11 IoCs
- Custom signatureDetects Windows executables referencing Office macro registry keys. Observed modifying Office config 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_708cf53b23e670649a1256c920a12bf1_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_708cf53b23e670649a1256c920a12bf1_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A207807-A6FA-46b6-8C16-33145FC26CF5}.exeC:\Windows\{3A207807-A6FA-46b6-8C16-33145FC26CF5}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{88A66BB9-67F1-40b7-9C9A-E6F079E1E17D}.exeC:\Windows\{88A66BB9-67F1-40b7-9C9A-E6F079E1E17D}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{100E25B1-C0FA-4f24-A22E-7CF8F599B7BC}.exeC:\Windows\{100E25B1-C0FA-4f24-A22E-7CF8F599B7BC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4D328003-815A-4431-BD87-D53E02BE47ED}.exeC:\Windows\{4D328003-815A-4431-BD87-D53E02BE47ED}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6C3F3325-A487-4425-ADC3-33DCD163A3FC}.exeC:\Windows\{6C3F3325-A487-4425-ADC3-33DCD163A3FC}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F0A99E40-CDE2-4627-9D27-A24BAA0854FF}.exeC:\Windows\{F0A99E40-CDE2-4627-9D27-A24BAA0854FF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9C000671-9B24-4d4f-8A55-034403F1A1C8}.exeC:\Windows\{9C000671-9B24-4d4f-8A55-034403F1A1C8}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8349793A-77D4-4043-B70C-DCF418EB0B20}.exeC:\Windows\{8349793A-77D4-4043-B70C-DCF418EB0B20}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{143E85A9-57B0-4e88-AD15-97506F89A0CD}.exeC:\Windows\{143E85A9-57B0-4e88-AD15-97506F89A0CD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{087A5183-72AF-45fc-A415-CCDEAC7685CC}.exeC:\Windows\{087A5183-72AF-45fc-A415-CCDEAC7685CC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8EF7547-0D7B-40fe-BC23-02A16447E042}.exeC:\Windows\{A8EF7547-0D7B-40fe-BC23-02A16447E042}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{087A5~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{143E8~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{83497~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9C000~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F0A99~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6C3F3~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4D328~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{100E2~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{88A66~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A207~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{087A5183-72AF-45fc-A415-CCDEAC7685CC}.exe
{100E25B1-C0FA-4f24-A22E-7CF8F599B7BC}.exe
{143E85A9-57B0-4e88-AD15-97506F89A0CD}.exe
{3A207807-A6FA-46b6-8C16-33145FC26CF5}.exe
{4D328003-815A-4431-BD87-D53E02BE47ED}.exe
{6C3F3325-A487-4425-ADC3-33DCD163A3FC}.exe
{8349793A-77D4-4043-B70C-DCF418EB0B20}.exe
{88A66BB9-67F1-40b7-9C9A-E6F079E1E17D}.exe
{9C000671-9B24-4d4f-8A55-034403F1A1C8}.exe
{A8EF7547-0D7B-40fe-BC23-02A16447E042}.exe
{F0A99E40-CDE2-4627-9D27-A24BAA0854FF}.exe
memory/2280-59-0x0000000000580000-0x000000000063F000-memory.dmp
memory/2280-54-0x0000000000580000-0x000000000063F000-memory.dmp
memory/3692-15-0x00000000007A0000-0x000000000085F000-memory.dmp
memory/3692-12-0x00000000007A0000-0x000000000085F000-memory.dmp
memory/3956-51-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/3956-48-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/4212-30-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/4212-34-0x00000000008E0000-0x000000000099F000-memory.dmp
memory/4244-18-0x00000000007E0000-0x000000000089F000-memory.dmp
memory/4244-22-0x00000000007E0000-0x000000000089F000-memory.dmp
memory/4544-4-0x00000000006B0000-0x000000000076F000-memory.dmp
memory/4544-0-0x00000000006B0000-0x000000000076F000-memory.dmp
memory/4588-60-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/4588-64-0x00000000008D0000-0x000000000098F000-memory.dmp
memory/4784-6-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/4784-10-0x00000000007B0000-0x000000000086F000-memory.dmp
memory/5184-46-0x00000000007F0000-0x00000000008AF000-memory.dmp
memory/5184-42-0x00000000007F0000-0x00000000008AF000-memory.dmp
memory/5436-28-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/5436-24-0x00000000008C0000-0x000000000097F000-memory.dmp
memory/5940-40-0x0000000000870000-0x000000000092F000-memory.dmp
memory/5940-36-0x0000000000870000-0x000000000092F000-memory.dmp