Analysis
- max time kernel
148s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 12:30
General
- Target 2026-07-09_a8e14072db7a9f63a5db0c455e906369_elex_goldeneye_wannacry.exe
- Size 344KB
- Sample260709-ppqm5sat7k
- SHA256 63f7033f69dd16aa5c7d0084b0623453ac7382d1c8a5212333653692693667c2
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_a8e14072db7a9f63a5db0c455e906369_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a8e14072db7a9f63a5db0c455e906369_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{6AB7474D-4601-40bc-8BB2-B55A71E44DD7}.exeC:\Windows\{6AB7474D-4601-40bc-8BB2-B55A71E44DD7}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{32233E21-DEA7-4861-AC24-CFA0C2374224}.exeC:\Windows\{32233E21-DEA7-4861-AC24-CFA0C2374224}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{00B28E42-CBBC-451f-AB38-58C60304195B}.exeC:\Windows\{00B28E42-CBBC-451f-AB38-58C60304195B}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A5A68A4B-4DE9-443c-ABF9-0EC882B355ED}.exeC:\Windows\{A5A68A4B-4DE9-443c-ABF9-0EC882B355ED}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{15E74B7B-6F13-4b3a-B028-B53170B9C91D}.exeC:\Windows\{15E74B7B-6F13-4b3a-B028-B53170B9C91D}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5A224E0A-C0B5-4486-B669-7EB23AB0FC2E}.exeC:\Windows\{5A224E0A-C0B5-4486-B669-7EB23AB0FC2E}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{127FBF6A-F7B5-4fe7-A3CE-8D82F8594D6C}.exeC:\Windows\{127FBF6A-F7B5-4fe7-A3CE-8D82F8594D6C}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9CFA608C-F88B-4a10-B3C4-8C5A44A3E30B}.exeC:\Windows\{9CFA608C-F88B-4a10-B3C4-8C5A44A3E30B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BAA74BF5-F803-4feb-8690-13727365B7D7}.exeC:\Windows\{BAA74BF5-F803-4feb-8690-13727365B7D7}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{368A04FC-5EE9-4835-8DFF-824EFD2ADBD6}.exeC:\Windows\{368A04FC-5EE9-4835-8DFF-824EFD2ADBD6}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEEEF2A2-F7FC-4e79-9A44-9B276B3C209D}.exeC:\Windows\{CEEEF2A2-F7FC-4e79-9A44-9B276B3C209D}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{368A0~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BAA74~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9CFA6~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{127FB~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5A224~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{15E74~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5A68~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{00B28~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{32233~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{6AB74~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{00B28E42-CBBC-451f-AB38-58C60304195B}.exe
{127FBF6A-F7B5-4fe7-A3CE-8D82F8594D6C}.exe
{15E74B7B-6F13-4b3a-B028-B53170B9C91D}.exe
{32233E21-DEA7-4861-AC24-CFA0C2374224}.exe
{368A04FC-5EE9-4835-8DFF-824EFD2ADBD6}.exe
{5A224E0A-C0B5-4486-B669-7EB23AB0FC2E}.exe
{6AB7474D-4601-40bc-8BB2-B55A71E44DD7}.exe
{9CFA608C-F88B-4a10-B3C4-8C5A44A3E30B}.exe
{A5A68A4B-4DE9-443c-ABF9-0EC882B355ED}.exe
{BAA74BF5-F803-4feb-8690-13727365B7D7}.exe
{CEEEF2A2-F7FC-4e79-9A44-9B276B3C209D}.exe