Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/05/2026, 15:01
General
- Target 2026-05-03_474f0f3e233ded7aff5b223e898ca8f6_elex_goldeneye_wannacry.exe
- Size 168KB
- Sample260503-sdvdqse15m
- SHA256 e51b9f7e7d422c57cb5f5f521fa5ca6b2bd719f051e540fddd9847bc884b22ee
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_474f0f3e233ded7aff5b223e898ca8f6_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_474f0f3e233ded7aff5b223e898ca8f6_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B41E178C-0BA7-4085-8E2A-7E0E9A5E2FFF}.exeC:\Windows\{B41E178C-0BA7-4085-8E2A-7E0E9A5E2FFF}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0C6EE3AC-7FB1-4738-A1C0-F4C565BB06F1}.exeC:\Windows\{0C6EE3AC-7FB1-4738-A1C0-F4C565BB06F1}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2C4C0FE-90CF-4f50-BE2A-D1475EA8C689}.exeC:\Windows\{F2C4C0FE-90CF-4f50-BE2A-D1475EA8C689}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EE38D94-8D68-4681-A84E-F097320AC1C8}.exeC:\Windows\{2EE38D94-8D68-4681-A84E-F097320AC1C8}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DDD2D0A7-0D4B-47c1-A10E-59D35BB05445}.exeC:\Windows\{DDD2D0A7-0D4B-47c1-A10E-59D35BB05445}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{85FAB42A-3EB8-4f69-9863-C2A052DEDE51}.exeC:\Windows\{85FAB42A-3EB8-4f69-9863-C2A052DEDE51}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{783BA323-56D3-43a1-8146-829569C08A35}.exeC:\Windows\{783BA323-56D3-43a1-8146-829569C08A35}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A04C361-41D1-40b5-BD73-56E658CBA243}.exeC:\Windows\{6A04C361-41D1-40b5-BD73-56E658CBA243}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76472F1C-B3BB-4395-9B9C-D0020F403992}.exeC:\Windows\{76472F1C-B3BB-4395-9B9C-D0020F403992}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6B4AAA9E-6E7E-4b9e-BE39-490B50AFA6E0}.exeC:\Windows\{6B4AAA9E-6E7E-4b9e-BE39-490B50AFA6E0}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{80F808A4-3CDB-415c-936F-7EA3E22C03BD}.exeC:\Windows\{80F808A4-3CDB-415c-936F-7EA3E22C03BD}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6B4AA~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76472~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A04C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{783BA~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{85FAB~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DDD2D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EE38~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2C4C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0C6EE~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B41E1~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0C6EE3AC-7FB1-4738-A1C0-F4C565BB06F1}.exe
{2EE38D94-8D68-4681-A84E-F097320AC1C8}.exe
{6A04C361-41D1-40b5-BD73-56E658CBA243}.exe
{6B4AAA9E-6E7E-4b9e-BE39-490B50AFA6E0}.exe
{76472F1C-B3BB-4395-9B9C-D0020F403992}.exe
{783BA323-56D3-43a1-8146-829569C08A35}.exe
{80F808A4-3CDB-415c-936F-7EA3E22C03BD}.exe
{85FAB42A-3EB8-4f69-9863-C2A052DEDE51}.exe
{B41E178C-0BA7-4085-8E2A-7E0E9A5E2FFF}.exe
{DDD2D0A7-0D4B-47c1-A10E-59D35BB05445}.exe
{F2C4C0FE-90CF-4f50-BE2A-D1475EA8C689}.exe
memory/924-48-0x0000000000590000-0x000000000060A000-memory.dmp
memory/1928-6-0x0000000000550000-0x00000000005CA000-memory.dmp
memory/1936-12-0x00000000007B0000-0x000000000082A000-memory.dmp
memory/2136-18-0x0000000000630000-0x00000000006AA000-memory.dmp
memory/2508-60-0x0000000000780000-0x00000000007FA000-memory.dmp
memory/2724-30-0x0000000000520000-0x000000000059A000-memory.dmp
memory/2900-42-0x0000000000730000-0x00000000007AA000-memory.dmp
memory/3420-24-0x0000000000520000-0x000000000059A000-memory.dmp
memory/4032-0-0x00000000005C0000-0x000000000063A000-memory.dmp
memory/4200-36-0x00000000007A0000-0x000000000081A000-memory.dmp
memory/5068-54-0x00000000004D0000-0x000000000054A000-memory.dmp