Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
12/07/2026, 16:32
General
- Target 2026-07-12_96cd8530d6213a2974a4faac06f9d0a2_elex_goldeneye_wannacry.exe
- Size 344KB
- Sample260712-t2dassfs6t
- SHA256 307e91923c8dfbb57f2de8ae9919265da763c9c220483a782b9338a3e5a00fea
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_96cd8530d6213a2974a4faac06f9d0a2_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_96cd8530d6213a2974a4faac06f9d0a2_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F9F2EF6B-9990-45c8-AD3A-4EB345D28DED}.exeC:\Windows\{F9F2EF6B-9990-45c8-AD3A-4EB345D28DED}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{981B503E-DBD3-4d7a-92BD-607DCC28FDDE}.exeC:\Windows\{981B503E-DBD3-4d7a-92BD-607DCC28FDDE}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{922114FF-0C42-4361-AD19-EFDE224765A6}.exeC:\Windows\{922114FF-0C42-4361-AD19-EFDE224765A6}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1C976CAF-B50F-4258-8EA8-FAABF1D00A67}.exeC:\Windows\{1C976CAF-B50F-4258-8EA8-FAABF1D00A67}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CEF23EB2-4019-445c-B68A-A670AE2B22B5}.exeC:\Windows\{CEF23EB2-4019-445c-B68A-A670AE2B22B5}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{35056343-C000-430f-891D-561A332D5D68}.exeC:\Windows\{35056343-C000-430f-891D-561A332D5D68}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E771FC74-D7A8-4b58-9912-63371C6D08B2}.exeC:\Windows\{E771FC74-D7A8-4b58-9912-63371C6D08B2}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E5D37431-5C20-448f-9AE4-8161333C59AE}.exeC:\Windows\{E5D37431-5C20-448f-9AE4-8161333C59AE}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D01A36DC-1AE6-4c46-96C9-683E9AB8A2C1}.exeC:\Windows\{D01A36DC-1AE6-4c46-96C9-683E9AB8A2C1}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FD5FD213-1379-423c-97D0-5F54F5BFA382}.exeC:\Windows\{FD5FD213-1379-423c-97D0-5F54F5BFA382}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1BEBD9DE-29C4-457b-AD22-C297556506EC}.exeC:\Windows\{1BEBD9DE-29C4-457b-AD22-C297556506EC}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FD5FD~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D01A3~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E5D37~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E771F~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{35056~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CEF23~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1C976~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92211~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{981B5~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F9F2E~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1BEBD9DE-29C4-457b-AD22-C297556506EC}.exe
{1C976CAF-B50F-4258-8EA8-FAABF1D00A67}.exe
{35056343-C000-430f-891D-561A332D5D68}.exe
{922114FF-0C42-4361-AD19-EFDE224765A6}.exe
{981B503E-DBD3-4d7a-92BD-607DCC28FDDE}.exe
{CEF23EB2-4019-445c-B68A-A670AE2B22B5}.exe
{D01A36DC-1AE6-4c46-96C9-683E9AB8A2C1}.exe
{E5D37431-5C20-448f-9AE4-8161333C59AE}.exe
{E771FC74-D7A8-4b58-9912-63371C6D08B2}.exe
{F9F2EF6B-9990-45c8-AD3A-4EB345D28DED}.exe
{FD5FD213-1379-423c-97D0-5F54F5BFA382}.exe