Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/07/2026, 03:47
General
- Target 2026-07-05_5be315dd9ed356bb296ea40becf7b28a_elex_goldeneye_wannacry.exe
- Size 468KB
- Sample260705-ecbckscy7k
- SHA256 520c4961b31dbcbd4ef34b35958457f4c5d1d735d76c430675e54b5039cb1a41
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Detects Windows executables referencing Office macro registry keys. Observed modifying Office config 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_5be315dd9ed356bb296ea40becf7b28a_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_5be315dd9ed356bb296ea40becf7b28a_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92B07FE6-C8DC-40bc-97B2-FE2DA6537335}.exeC:\Windows\{92B07FE6-C8DC-40bc-97B2-FE2DA6537335}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{947DFB76-55ED-4179-BB02-5CD73E09D59E}.exeC:\Windows\{947DFB76-55ED-4179-BB02-5CD73E09D59E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C644EEBA-0520-4995-BDE5-41C84264BFCE}.exeC:\Windows\{C644EEBA-0520-4995-BDE5-41C84264BFCE}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6BDCEE38-C272-43bb-BF38-1ECDDAD6A2F4}.exeC:\Windows\{6BDCEE38-C272-43bb-BF38-1ECDDAD6A2F4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{89B6ADFC-4FE3-49f4-8EDA-F45AA5F8F0A0}.exeC:\Windows\{89B6ADFC-4FE3-49f4-8EDA-F45AA5F8F0A0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9711322F-442E-47ac-8810-5282CBEEE4F8}.exeC:\Windows\{9711322F-442E-47ac-8810-5282CBEEE4F8}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A759BBD2-21E0-4ff4-A544-D94D8D90F7C6}.exeC:\Windows\{A759BBD2-21E0-4ff4-A544-D94D8D90F7C6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C6CF6EE0-E31E-4008-884B-A8AC9F639F79}.exeC:\Windows\{C6CF6EE0-E31E-4008-884B-A8AC9F639F79}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4665FD83-FA72-4b4f-8B47-DE54520227EE}.exeC:\Windows\{4665FD83-FA72-4b4f-8B47-DE54520227EE}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0449C2D8-6CBE-4a8e-B7A8-EEFE23586469}.exeC:\Windows\{0449C2D8-6CBE-4a8e-B7A8-EEFE23586469}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FC5845F5-AAB5-427e-9742-5EE01A0E9289}.exeC:\Windows\{FC5845F5-AAB5-427e-9742-5EE01A0E9289}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0449C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4665F~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C6CF6~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A759B~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97113~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{89B6A~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6BDCE~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C644E~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{947DF~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92B07~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0449C2D8-6CBE-4a8e-B7A8-EEFE23586469}.exe
{4665FD83-FA72-4b4f-8B47-DE54520227EE}.exe
{6BDCEE38-C272-43bb-BF38-1ECDDAD6A2F4}.exe
{89B6ADFC-4FE3-49f4-8EDA-F45AA5F8F0A0}.exe
{92B07FE6-C8DC-40bc-97B2-FE2DA6537335}.exe
{947DFB76-55ED-4179-BB02-5CD73E09D59E}.exe
{9711322F-442E-47ac-8810-5282CBEEE4F8}.exe
{A759BBD2-21E0-4ff4-A544-D94D8D90F7C6}.exe
{C644EEBA-0520-4995-BDE5-41C84264BFCE}.exe
{C6CF6EE0-E31E-4008-884B-A8AC9F639F79}.exe
{FC5845F5-AAB5-427e-9742-5EE01A0E9289}.exe