Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 18:28
General
- Target 2026-07-04_769236ba347ae91ba872b32eb54742a1_elex_goldeneye_wannacry.exe
- Size 344KB
- Sample260704-w4rbjsfx7k
- SHA256 e061558104ff272fa0064411adfd973b633f01767eda3df41c6f5261e58fb6e6
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-04_769236ba347ae91ba872b32eb54742a1_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-04_769236ba347ae91ba872b32eb54742a1_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C77C3E32-8FAB-4e88-ABE1-716D2B8EDDD4}.exeC:\Windows\{C77C3E32-8FAB-4e88-ABE1-716D2B8EDDD4}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B2B85084-27DE-47f4-8C4C-15D72EA42F79}.exeC:\Windows\{B2B85084-27DE-47f4-8C4C-15D72EA42F79}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5CDC2325-0A76-4f97-88E1-950B495DE393}.exeC:\Windows\{5CDC2325-0A76-4f97-88E1-950B495DE393}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{750A93F5-AF47-47a9-83DE-7D91CF5DAC80}.exeC:\Windows\{750A93F5-AF47-47a9-83DE-7D91CF5DAC80}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A22F9057-167B-4e6d-9D55-110F01DE2CC3}.exeC:\Windows\{A22F9057-167B-4e6d-9D55-110F01DE2CC3}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4AC61B55-07B3-4b43-8C70-1E184E74ADAF}.exeC:\Windows\{4AC61B55-07B3-4b43-8C70-1E184E74ADAF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F960BD32-6AFD-43ab-A977-F2E3AF263FA4}.exeC:\Windows\{F960BD32-6AFD-43ab-A977-F2E3AF263FA4}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A8DDD4D9-882C-40d5-86E0-347B46EF9DAC}.exeC:\Windows\{A8DDD4D9-882C-40d5-86E0-347B46EF9DAC}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1F198647-F7FC-4337-BF41-23AFE7A177D5}.exeC:\Windows\{1F198647-F7FC-4337-BF41-23AFE7A177D5}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{17F56279-B70C-4866-93AF-038FA551EE2E}.exeC:\Windows\{17F56279-B70C-4866-93AF-038FA551EE2E}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8238932D-8572-46f7-B93A-F9E977B5F2B1}.exeC:\Windows\{8238932D-8572-46f7-B93A-F9E977B5F2B1}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{17F56~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1F198~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A8DDD~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F960B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4AC61~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A22F9~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{750A9~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5CDC2~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2B85~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C77C3~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{17F56279-B70C-4866-93AF-038FA551EE2E}.exe
{1F198647-F7FC-4337-BF41-23AFE7A177D5}.exe
{4AC61B55-07B3-4b43-8C70-1E184E74ADAF}.exe
{5CDC2325-0A76-4f97-88E1-950B495DE393}.exe
{750A93F5-AF47-47a9-83DE-7D91CF5DAC80}.exe
{8238932D-8572-46f7-B93A-F9E977B5F2B1}.exe
{A22F9057-167B-4e6d-9D55-110F01DE2CC3}.exe
{A8DDD4D9-882C-40d5-86E0-347B46EF9DAC}.exe
{B2B85084-27DE-47f4-8C4C-15D72EA42F79}.exe
{C77C3E32-8FAB-4e88-ABE1-716D2B8EDDD4}.exe
{F960BD32-6AFD-43ab-A977-F2E3AF263FA4}.exe