Analysis
- max time kernel
149s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/06/2026, 03:47
General
- Target 2026-06-27_b2450856c557bcd927baf3a3ef4e9b91_elex_goldeneye_wannacry.exe
- Size 168KB
- Sample260629-echfwsdw9n
- SHA256 3f31bf30fc8c01f8278b0fdc9399492f89688bf9f985553dfa0dbf848aab9081
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 7 IoCs
- Auto-generated rule 7 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 7 IoCs
- Drops file in Windows directory 7 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_b2450856c557bcd927baf3a3ef4e9b91_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b2450856c557bcd927baf3a3ef4e9b91_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E99E3C35-5758-46ca-93F0-FFA7D8A8575D}.exeC:\Windows\{E99E3C35-5758-46ca-93F0-FFA7D8A8575D}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AB05E347-49F8-458f-B9EF-5E47AF0DEC12}.exeC:\Windows\{AB05E347-49F8-458f-B9EF-5E47AF0DEC12}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B0E6F6B6-74BD-4225-AB51-4E20ED696976}.exeC:\Windows\{B0E6F6B6-74BD-4225-AB51-4E20ED696976}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA814A61-6691-490b-98F6-6187F6EBA762}.exeC:\Windows\{AA814A61-6691-490b-98F6-6187F6EBA762}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6A18996C-37A6-41a7-8FE7-311CFBE07152}.exeC:\Windows\{6A18996C-37A6-41a7-8FE7-311CFBE07152}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DF2F04C2-2B99-4a3b-A772-12EE6C4FF9BA}.exeC:\Windows\{DF2F04C2-2B99-4a3b-A772-12EE6C4FF9BA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E32D3EB9-D2A5-4731-B6B4-F8300F83F83D}.exeC:\Windows\{E32D3EB9-D2A5-4731-B6B4-F8300F83F83D}.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DF2F0~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6A189~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AA814~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B0E6F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AB05E~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E99E3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{6A18996C-37A6-41a7-8FE7-311CFBE07152}.exe
{AA814A61-6691-490b-98F6-6187F6EBA762}.exe
{AB05E347-49F8-458f-B9EF-5E47AF0DEC12}.exe
{B0E6F6B6-74BD-4225-AB51-4E20ED696976}.exe
{DF2F04C2-2B99-4a3b-A772-12EE6C4FF9BA}.exe
{E32D3EB9-D2A5-4731-B6B4-F8300F83F83D}.exe
{E99E3C35-5758-46ca-93F0-FFA7D8A8575D}.exe