Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
05/07/2026, 15:55
General
- Target 2026-07-05_bba024d47e3cc0f14398cf32a25addbb_elex_goldeneye_wannacry.exe
- Size 180KB
- Sample260705-tc4fpahs4j
- SHA256 8e8527a8f0e63c2ee4617553406dfe837eba30a7c9ba6ca9f86a9c58662dbf65
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_bba024d47e3cc0f14398cf32a25addbb_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_bba024d47e3cc0f14398cf32a25addbb_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E592AF56-5ACB-4b05-817C-32315DFA1CFA}.exeC:\Windows\{E592AF56-5ACB-4b05-817C-32315DFA1CFA}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2357339B-22A7-40b0-A20E-5FF8E411F45A}.exeC:\Windows\{2357339B-22A7-40b0-A20E-5FF8E411F45A}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{97C4FF07-478D-41a3-AC1A-E5B5F0B77320}.exeC:\Windows\{97C4FF07-478D-41a3-AC1A-E5B5F0B77320}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{691870FD-A7DC-4520-924E-F7CB70A6C7AC}.exeC:\Windows\{691870FD-A7DC-4520-924E-F7CB70A6C7AC}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{46D02856-2749-497e-9060-C8CA3148D3B9}.exeC:\Windows\{46D02856-2749-497e-9060-C8CA3148D3B9}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{868DA0DB-8A06-4276-9D65-528C6B64371E}.exeC:\Windows\{868DA0DB-8A06-4276-9D65-528C6B64371E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{51C890AA-DA95-4ecb-9DD9-F0CF46918D81}.exeC:\Windows\{51C890AA-DA95-4ecb-9DD9-F0CF46918D81}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{468C9C10-4940-4427-9F04-C510A3A56282}.exeC:\Windows\{468C9C10-4940-4427-9F04-C510A3A56282}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B97C271E-12FF-4655-B150-6127BE39AC95}.exeC:\Windows\{B97C271E-12FF-4655-B150-6127BE39AC95}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9BC76888-2ED1-4ece-85D4-D6E1CE268158}.exeC:\Windows\{9BC76888-2ED1-4ece-85D4-D6E1CE268158}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{94EC3D71-E7A6-4bb5-8406-E3F0C8D35919}.exeC:\Windows\{94EC3D71-E7A6-4bb5-8406-E3F0C8D35919}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9BC76~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B97C2~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{468C9~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{51C89~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{868DA~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46D02~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69187~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97C4F~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{23573~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E592A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{2357339B-22A7-40b0-A20E-5FF8E411F45A}.exe
{468C9C10-4940-4427-9F04-C510A3A56282}.exe
{46D02856-2749-497e-9060-C8CA3148D3B9}.exe
{51C890AA-DA95-4ecb-9DD9-F0CF46918D81}.exe
{691870FD-A7DC-4520-924E-F7CB70A6C7AC}.exe
{868DA0DB-8A06-4276-9D65-528C6B64371E}.exe
{94EC3D71-E7A6-4bb5-8406-E3F0C8D35919}.exe
{97C4FF07-478D-41a3-AC1A-E5B5F0B77320}.exe
{9BC76888-2ED1-4ece-85D4-D6E1CE268158}.exe
{B97C271E-12FF-4655-B150-6127BE39AC95}.exe
{E592AF56-5ACB-4b05-817C-32315DFA1CFA}.exe