Analysis
- max time kernel
150s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
03/07/2026, 19:08
General
- Target 2026-07-03_76b7f86403415fa2baf61058efab96e4_elex_goldeneye_wannacry.exe
- Size 168KB
- Sample260703-xtds5sbt8k
- SHA256 fe6d7002308db0773c111f7c166abca46b60dd5015872c6e6c96d4bacd399400
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 10 IoCs
- Auto-generated rule 10 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 10 IoCs
- Drops file in Windows directory 10 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_76b7f86403415fa2baf61058efab96e4_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_76b7f86403415fa2baf61058efab96e4_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37339EB4-D183-49f1-889E-5601E48F19D4}.exeC:\Windows\{37339EB4-D183-49f1-889E-5601E48F19D4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FE151E14-1574-41b7-B21B-212A4691C4A2}.exeC:\Windows\{FE151E14-1574-41b7-B21B-212A4691C4A2}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5E94C90A-3B7D-4eba-AD5D-6D14E792DD73}.exeC:\Windows\{5E94C90A-3B7D-4eba-AD5D-6D14E792DD73}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9DA12AEB-BD66-429d-978F-97693E5CEAEB}.exeC:\Windows\{9DA12AEB-BD66-429d-978F-97693E5CEAEB}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8EE7EC23-0F5F-40ff-99AB-0FDBBDC36BE6}.exeC:\Windows\{8EE7EC23-0F5F-40ff-99AB-0FDBBDC36BE6}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E36AB86-AFD5-45ab-9ED8-28A624F41F23}.exeC:\Windows\{0E36AB86-AFD5-45ab-9ED8-28A624F41F23}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9B278324-0DA7-4bcf-A01F-9B10AEE8855A}.exeC:\Windows\{9B278324-0DA7-4bcf-A01F-9B10AEE8855A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{37AF9B11-35CA-45f3-9C4F-F61FEB662D72}.exeC:\Windows\{37AF9B11-35CA-45f3-9C4F-F61FEB662D72}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EDDE97BD-66B2-4ad0-A3AE-B43EC079DCB1}.exeC:\Windows\{EDDE97BD-66B2-4ad0-A3AE-B43EC079DCB1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B739809B-087D-4c57-9290-189AB2C65879}.exeC:\Windows\{B739809B-087D-4c57-9290-189AB2C65879}.exe11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EDDE9~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37AF9~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9B278~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E36A~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8EE7E~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9DA12~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5E94C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FE151~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{37339~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0E36AB86-AFD5-45ab-9ED8-28A624F41F23}.exe
{37339EB4-D183-49f1-889E-5601E48F19D4}.exe
{37AF9B11-35CA-45f3-9C4F-F61FEB662D72}.exe
{5E94C90A-3B7D-4eba-AD5D-6D14E792DD73}.exe
{8EE7EC23-0F5F-40ff-99AB-0FDBBDC36BE6}.exe
{9B278324-0DA7-4bcf-A01F-9B10AEE8855A}.exe
{9DA12AEB-BD66-429d-978F-97693E5CEAEB}.exe
{B739809B-087D-4c57-9290-189AB2C65879}.exe
{EDDE97BD-66B2-4ad0-A3AE-B43EC079DCB1}.exe
{FE151E14-1574-41b7-B21B-212A4691C4A2}.exe