Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
12/07/2026, 10:47
General
- Target 2026-07-12_f7a5afaebf95b8733cbf61d23d610dde_elex_goldeneye_wannacry.exe
- Size 216KB
- Sample260712-mvs94sas61
- SHA256 fbf499217d39452b0014c9f121b8d055cd402d8bf3f1e24a004ffbad7c198370
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_f7a5afaebf95b8733cbf61d23d610dde_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_f7a5afaebf95b8733cbf61d23d610dde_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F67BCBEA-FA2C-4ad0-AD22-4EB54A9C8256}.exeC:\Windows\{F67BCBEA-FA2C-4ad0-AD22-4EB54A9C8256}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2F30B7B7-AD72-47bc-8AAF-DB47688354FC}.exeC:\Windows\{2F30B7B7-AD72-47bc-8AAF-DB47688354FC}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3547797B-91D7-4fb2-8E9C-0FEAB110B00E}.exeC:\Windows\{3547797B-91D7-4fb2-8E9C-0FEAB110B00E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{785CBB99-3C00-43be-84C1-F86FA1AA2E8B}.exeC:\Windows\{785CBB99-3C00-43be-84C1-F86FA1AA2E8B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{79B35A2C-4803-4bb1-92FC-1EF662095D4E}.exeC:\Windows\{79B35A2C-4803-4bb1-92FC-1EF662095D4E}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{021E332C-8FA0-4459-A9CD-BCCB00F375BB}.exeC:\Windows\{021E332C-8FA0-4459-A9CD-BCCB00F375BB}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F6ABD25F-3AF1-4f4e-96D1-0C13B8F38D4A}.exeC:\Windows\{F6ABD25F-3AF1-4f4e-96D1-0C13B8F38D4A}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{976399BA-7058-4b31-8581-819D28E2D7FB}.exeC:\Windows\{976399BA-7058-4b31-8581-819D28E2D7FB}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{466340FC-1B28-4be0-B36E-B0DC108C6F87}.exeC:\Windows\{466340FC-1B28-4be0-B36E-B0DC108C6F87}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A4F6CEF4-675C-4a59-B12C-56F5F2C00177}.exeC:\Windows\{A4F6CEF4-675C-4a59-B12C-56F5F2C00177}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{515120E5-808E-43a7-9891-6F71720838A6}.exeC:\Windows\{515120E5-808E-43a7-9891-6F71720838A6}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A4F6C~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{46634~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{97639~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F6ABD~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{021E3~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79B35~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{785CB~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35477~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2F30B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F67BC~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{021E332C-8FA0-4459-A9CD-BCCB00F375BB}.exe
{2F30B7B7-AD72-47bc-8AAF-DB47688354FC}.exe
{3547797B-91D7-4fb2-8E9C-0FEAB110B00E}.exe
{466340FC-1B28-4be0-B36E-B0DC108C6F87}.exe
{515120E5-808E-43a7-9891-6F71720838A6}.exe
{785CBB99-3C00-43be-84C1-F86FA1AA2E8B}.exe
{79B35A2C-4803-4bb1-92FC-1EF662095D4E}.exe
{976399BA-7058-4b31-8581-819D28E2D7FB}.exe
{A4F6CEF4-675C-4a59-B12C-56F5F2C00177}.exe
{F67BCBEA-FA2C-4ad0-AD22-4EB54A9C8256}.exe
{F6ABD25F-3AF1-4f4e-96D1-0C13B8F38D4A}.exe