Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 18:14
General
- Target 2026-07-10_2e80e7995f1501107d77af04b2c36e78_elex_goldeneye_wannacry.exe
- Size 216KB
- Sample260710-wvb59set7l
- SHA256 8e07f230ab87ad64969394b20a8642300fd1679f21dfbd335c95f94e538527dd
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_2e80e7995f1501107d77af04b2c36e78_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_2e80e7995f1501107d77af04b2c36e78_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F8B1BAD0-4101-4435-85AC-BB574BB1C3B0}.exeC:\Windows\{F8B1BAD0-4101-4435-85AC-BB574BB1C3B0}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE9ABB6C-2302-4c6d-B61E-8C9AAC51DAE6}.exeC:\Windows\{AE9ABB6C-2302-4c6d-B61E-8C9AAC51DAE6}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{028771AD-F3B4-4f3e-99FC-5F3647D4ACB8}.exeC:\Windows\{028771AD-F3B4-4f3e-99FC-5F3647D4ACB8}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{98459AC4-3E6A-4cca-81B0-625F3B19D7C4}.exeC:\Windows\{98459AC4-3E6A-4cca-81B0-625F3B19D7C4}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF78D218-83FC-42d3-BA70-CB0C5F4290A8}.exeC:\Windows\{CF78D218-83FC-42d3-BA70-CB0C5F4290A8}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{750684E6-DACA-4027-B780-9234C1AEDBA5}.exeC:\Windows\{750684E6-DACA-4027-B780-9234C1AEDBA5}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{69753CA3-FBAF-4f57-B2AC-C80002AE4C30}.exeC:\Windows\{69753CA3-FBAF-4f57-B2AC-C80002AE4C30}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5273351E-08E9-4101-8C49-D4F67CB349D1}.exeC:\Windows\{5273351E-08E9-4101-8C49-D4F67CB349D1}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1E2F135B-B39C-467b-A200-EF1FFAA4F7CD}.exeC:\Windows\{1E2F135B-B39C-467b-A200-EF1FFAA4F7CD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3A5B78B4-E074-4006-BC98-3B2501EDFEAA}.exeC:\Windows\{3A5B78B4-E074-4006-BC98-3B2501EDFEAA}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{75279421-A06C-4574-85F6-D91562E533CD}.exeC:\Windows\{75279421-A06C-4574-85F6-D91562E533CD}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3A5B7~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1E2F1~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{52733~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{69753~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{75068~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF78D~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{98459~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{02877~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE9AB~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F8B1B~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{028771AD-F3B4-4f3e-99FC-5F3647D4ACB8}.exe
{1E2F135B-B39C-467b-A200-EF1FFAA4F7CD}.exe
{3A5B78B4-E074-4006-BC98-3B2501EDFEAA}.exe
{5273351E-08E9-4101-8C49-D4F67CB349D1}.exe
{69753CA3-FBAF-4f57-B2AC-C80002AE4C30}.exe
{750684E6-DACA-4027-B780-9234C1AEDBA5}.exe
{75279421-A06C-4574-85F6-D91562E533CD}.exe
{98459AC4-3E6A-4cca-81B0-625F3B19D7C4}.exe
{AE9ABB6C-2302-4c6d-B61E-8C9AAC51DAE6}.exe
{CF78D218-83FC-42d3-BA70-CB0C5F4290A8}.exe
{F8B1BAD0-4101-4435-85AC-BB574BB1C3B0}.exe