Analysis
- max time kernel
148s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 06:38
General
- Target 2026-07-04_bba98b44fde64f70b985bf7ef94b51a9_elex_goldeneye_wannacry.exe
- Size 344KB
- Sample260704-hd63esb18v
- SHA256 d1592a69393b4e6b9b7018fa2241814861adc600b3366b70d5b22c07e98ce81e
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_bba98b44fde64f70b985bf7ef94b51a9_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_bba98b44fde64f70b985bf7ef94b51a9_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AF6F0E89-5DFF-4e2e-AD37-FD112F6638D4}.exeC:\Windows\{AF6F0E89-5DFF-4e2e-AD37-FD112F6638D4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BD31C93A-15F0-46f4-AA43-D6B312ED66DF}.exeC:\Windows\{BD31C93A-15F0-46f4-AA43-D6B312ED66DF}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{44E8C6F6-A25C-486a-91D6-898AF31869AC}.exeC:\Windows\{44E8C6F6-A25C-486a-91D6-898AF31869AC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E0729E79-B123-4607-A13A-B0274E95A9DF}.exeC:\Windows\{E0729E79-B123-4607-A13A-B0274E95A9DF}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{831A6602-BF88-4317-9F7C-CF292DC8ABF7}.exeC:\Windows\{831A6602-BF88-4317-9F7C-CF292DC8ABF7}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5EF9577F-CD75-4556-B440-157D2DE4C928}.exeC:\Windows\{5EF9577F-CD75-4556-B440-157D2DE4C928}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{91CB2404-E7C6-478b-87BC-4463B844E4EF}.exeC:\Windows\{91CB2404-E7C6-478b-87BC-4463B844E4EF}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{90B9C34C-218F-4f92-A0E4-3AA83B956709}.exeC:\Windows\{90B9C34C-218F-4f92-A0E4-3AA83B956709}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BEDF8097-A948-4b2d-A24B-F4DD9EA22D7B}.exeC:\Windows\{BEDF8097-A948-4b2d-A24B-F4DD9EA22D7B}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC43FD99-1325-486f-BAA7-89EAB1365C6E}.exeC:\Windows\{FC43FD99-1325-486f-BAA7-89EAB1365C6E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8038431-94D0-4ca9-926E-A74DE80EB535}.exeC:\Windows\{D8038431-94D0-4ca9-926E-A74DE80EB535}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FC43F~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BEDF8~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{90B9C~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{91CB2~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5EF95~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{831A6~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E0729~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{44E8C~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD31C~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AF6F0~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{44E8C6F6-A25C-486a-91D6-898AF31869AC}.exe
{5EF9577F-CD75-4556-B440-157D2DE4C928}.exe
{831A6602-BF88-4317-9F7C-CF292DC8ABF7}.exe
{90B9C34C-218F-4f92-A0E4-3AA83B956709}.exe
{91CB2404-E7C6-478b-87BC-4463B844E4EF}.exe
{AF6F0E89-5DFF-4e2e-AD37-FD112F6638D4}.exe
{BD31C93A-15F0-46f4-AA43-D6B312ED66DF}.exe
{BEDF8097-A948-4b2d-A24B-F4DD9EA22D7B}.exe
{D8038431-94D0-4ca9-926E-A74DE80EB535}.exe
{E0729E79-B123-4607-A13A-B0274E95A9DF}.exe
{FC43FD99-1325-486f-BAA7-89EAB1365C6E}.exe