Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
06/05/2026, 11:48
General
- Target 2026-05-06_6c7772489c4815be7b5341140e7494b0_elex_goldeneye_wannacry.exe
- Size 349KB
- Sample260506-nylvwahs4v
- SHA256 aa2d84493c8cdcd8de4b388c063bc58880ef5c6790cbb03e754708b3acfc114b
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 9 IoCs
- Auto-generated rule 9 IoCs
- Detects Windows executables referencing Office macro registry keys. Observed modifying Office config 9 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 9 IoCs
- Drops file in Windows directory 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_6c7772489c4815be7b5341140e7494b0_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_6c7772489c4815be7b5341140e7494b0_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F01B3843-E0B8-42c0-91EE-3A604C286E0E}.exeC:\Windows\{F01B3843-E0B8-42c0-91EE-3A604C286E0E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EDC786B-CB1A-4440-8E77-E1682012D0FC}.exeC:\Windows\{2EDC786B-CB1A-4440-8E77-E1682012D0FC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8BCCEF95-43EC-4bfe-9D37-0590766F3FEB}.exeC:\Windows\{8BCCEF95-43EC-4bfe-9D37-0590766F3FEB}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{20FA5117-9749-47f7-9E10-8569B45C2450}.exeC:\Windows\{20FA5117-9749-47f7-9E10-8569B45C2450}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7879C10E-5654-4475-B07D-A70E5A87AD07}.exeC:\Windows\{7879C10E-5654-4475-B07D-A70E5A87AD07}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{260A3718-6CBE-4777-9792-D94330792496}.exeC:\Windows\{260A3718-6CBE-4777-9792-D94330792496}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9F1824CB-2E62-4a1a-9247-F2D22E9800D4}.exeC:\Windows\{9F1824CB-2E62-4a1a-9247-F2D22E9800D4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FB3296EE-D9AF-4917-BF8B-E3324215F26D}.exeC:\Windows\{FB3296EE-D9AF-4917-BF8B-E3324215F26D}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E92EFBE9-9D58-44a8-A0BC-1E6F3D6FC6F2}.exeC:\Windows\{E92EFBE9-9D58-44a8-A0BC-1E6F3D6FC6F2}.exe10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FB329~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9F182~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{260A3~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7879C~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{20FA5~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8BCCE~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EDC7~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F01B3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{20FA5117-9749-47f7-9E10-8569B45C2450}.exe
{260A3718-6CBE-4777-9792-D94330792496}.exe
{2EDC786B-CB1A-4440-8E77-E1682012D0FC}.exe
{7879C10E-5654-4475-B07D-A70E5A87AD07}.exe
{8BCCEF95-43EC-4bfe-9D37-0590766F3FEB}.exe
{9F1824CB-2E62-4a1a-9247-F2D22E9800D4}.exe
{E92EFBE9-9D58-44a8-A0BC-1E6F3D6FC6F2}.exe
{F01B3843-E0B8-42c0-91EE-3A604C286E0E}.exe
{FB3296EE-D9AF-4917-BF8B-E3324215F26D}.exe
memory/468-41-0x0000000000990000-0x0000000000A51000-memory.dmp
memory/468-37-0x0000000000990000-0x0000000000A51000-memory.dmp
memory/1108-25-0x0000000000980000-0x0000000000A41000-memory.dmp
memory/1108-29-0x0000000000980000-0x0000000000A41000-memory.dmp
memory/3620-23-0x0000000000880000-0x0000000000941000-memory.dmp
memory/3620-19-0x0000000000880000-0x0000000000941000-memory.dmp
memory/3720-5-0x0000000000AF0000-0x0000000000BB1000-memory.dmp
memory/3720-0-0x0000000000AF0000-0x0000000000BB1000-memory.dmp
memory/3912-11-0x0000000000670000-0x0000000000731000-memory.dmp
memory/3912-7-0x0000000000670000-0x0000000000731000-memory.dmp
memory/4156-49-0x00000000009C0000-0x0000000000A81000-memory.dmp
memory/4156-53-0x00000000009C0000-0x0000000000A81000-memory.dmp
memory/4508-17-0x0000000000840000-0x0000000000901000-memory.dmp
memory/4508-13-0x0000000000840000-0x0000000000901000-memory.dmp
memory/5900-43-0x0000000000840000-0x0000000000901000-memory.dmp
memory/5900-47-0x0000000000840000-0x0000000000901000-memory.dmp
memory/6020-34-0x0000000000880000-0x0000000000941000-memory.dmp
memory/6020-31-0x0000000000880000-0x0000000000941000-memory.dmp