Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
08/07/2026, 17:38
General
- Target 2026-07-08_76e2d5006ca5183155b6a1520a590380_elex_goldeneye_wannacry.exe
- Size 344KB
- Sample260708-v7465sdx3j
- SHA256 0f61fc5f84d8d162fd769c7ea6be87bff1a9dce63810e62737af845cffa9f548
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_76e2d5006ca5183155b6a1520a590380_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_76e2d5006ca5183155b6a1520a590380_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{644EE8D8-5F2A-4875-B0AE-5029BC33753B}.exeC:\Windows\{644EE8D8-5F2A-4875-B0AE-5029BC33753B}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0B0439AD-5636-4e21-B2B8-11D67E43CBC6}.exeC:\Windows\{0B0439AD-5636-4e21-B2B8-11D67E43CBC6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FAAF7B81-A9D1-4e32-9E70-42BE6AA44DE9}.exeC:\Windows\{FAAF7B81-A9D1-4e32-9E70-42BE6AA44DE9}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3A6CACA-76CA-47a9-82CD-DEA7380C2B99}.exeC:\Windows\{C3A6CACA-76CA-47a9-82CD-DEA7380C2B99}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{65D23546-3898-45e9-99A5-714CBAC1EC4B}.exeC:\Windows\{65D23546-3898-45e9-99A5-714CBAC1EC4B}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{43921F75-ADBF-4d02-BCA6-01AF38CCEE3E}.exeC:\Windows\{43921F75-ADBF-4d02-BCA6-01AF38CCEE3E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CB3B8327-B595-4a8a-BA8E-7E65B72868A7}.exeC:\Windows\{CB3B8327-B595-4a8a-BA8E-7E65B72868A7}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ADE31746-F588-4816-8485-63C8497440E7}.exeC:\Windows\{ADE31746-F588-4816-8485-63C8497440E7}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D108B016-63CC-4f13-86D2-A0A2A523A444}.exeC:\Windows\{D108B016-63CC-4f13-86D2-A0A2A523A444}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE08FFFF-E530-440a-A502-E3C3D6F9C38A}.exeC:\Windows\{AE08FFFF-E530-440a-A502-E3C3D6F9C38A}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0DC2CE7C-F478-4c45-9808-8C32D52FDAC6}.exeC:\Windows\{0DC2CE7C-F478-4c45-9808-8C32D52FDAC6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE08F~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D108B~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ADE31~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CB3B8~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{43921~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65D23~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3A6C~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FAAF7~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0B043~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{644EE~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0B0439AD-5636-4e21-B2B8-11D67E43CBC6}.exe
{0DC2CE7C-F478-4c45-9808-8C32D52FDAC6}.exe
{43921F75-ADBF-4d02-BCA6-01AF38CCEE3E}.exe
{644EE8D8-5F2A-4875-B0AE-5029BC33753B}.exe
{65D23546-3898-45e9-99A5-714CBAC1EC4B}.exe
{ADE31746-F588-4816-8485-63C8497440E7}.exe
{AE08FFFF-E530-440a-A502-E3C3D6F9C38A}.exe
{C3A6CACA-76CA-47a9-82CD-DEA7380C2B99}.exe
{CB3B8327-B595-4a8a-BA8E-7E65B72868A7}.exe
{D108B016-63CC-4f13-86D2-A0A2A523A444}.exe
{FAAF7B81-A9D1-4e32-9E70-42BE6AA44DE9}.exe