Analysis
- max time kernel
148s - max time network
113s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
12/07/2026, 16:42
General
- Target 2026-07-12_8596d192ec28b3d74f499b4e3ea6bc9f_elex_goldeneye_wannacry.exe
- Size 168KB
- Sample260712-t7qs3sft91
- SHA256 e7414c9935b147711785512e50ab06569e668a5f0f6ac2b2af9763ee9eaa0004
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_8596d192ec28b3d74f499b4e3ea6bc9f_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_8596d192ec28b3d74f499b4e3ea6bc9f_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3341A40D-D0C1-40df-90D3-F15491A81491}.exeC:\Windows\{3341A40D-D0C1-40df-90D3-F15491A81491}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A522526C-7840-4ad8-9CDE-4E8AC65DDC48}.exeC:\Windows\{A522526C-7840-4ad8-9CDE-4E8AC65DDC48}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{77078C8D-094D-4515-9B99-180B8D0D2AB3}.exeC:\Windows\{77078C8D-094D-4515-9B99-180B8D0D2AB3}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F1B3209E-7406-4ab5-A45A-4303691F2810}.exeC:\Windows\{F1B3209E-7406-4ab5-A45A-4303691F2810}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2B25C83-812E-486f-A5E9-C3E785A54337}.exeC:\Windows\{F2B25C83-812E-486f-A5E9-C3E785A54337}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D6C3B610-678B-4fe9-82BE-88F1B72AF1EA}.exeC:\Windows\{D6C3B610-678B-4fe9-82BE-88F1B72AF1EA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5456D331-71C8-47ab-B3D2-3CF2EDF1CCC6}.exeC:\Windows\{5456D331-71C8-47ab-B3D2-3CF2EDF1CCC6}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{5898F950-828E-45d9-80BC-8BF6E338A90F}.exeC:\Windows\{5898F950-828E-45d9-80BC-8BF6E338A90F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A7D378F7-6D9C-43ea-91C1-2FD0A54C359F}.exeC:\Windows\{A7D378F7-6D9C-43ea-91C1-2FD0A54C359F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D606A30C-B6D3-41c8-8B83-E631DA036C17}.exeC:\Windows\{D606A30C-B6D3-41c8-8B83-E631DA036C17}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8FAFD857-4035-4611-80D0-00AB772CDE2E}.exeC:\Windows\{8FAFD857-4035-4611-80D0-00AB772CDE2E}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D606A~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A7D37~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5898F~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5456D~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D6C3B~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2B25~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F1B32~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{77078~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A5225~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3341A~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{3341A40D-D0C1-40df-90D3-F15491A81491}.exe
{5456D331-71C8-47ab-B3D2-3CF2EDF1CCC6}.exe
{5898F950-828E-45d9-80BC-8BF6E338A90F}.exe
{77078C8D-094D-4515-9B99-180B8D0D2AB3}.exe
{8FAFD857-4035-4611-80D0-00AB772CDE2E}.exe
{A522526C-7840-4ad8-9CDE-4E8AC65DDC48}.exe
{A7D378F7-6D9C-43ea-91C1-2FD0A54C359F}.exe
{D606A30C-B6D3-41c8-8B83-E631DA036C17}.exe
{D6C3B610-678B-4fe9-82BE-88F1B72AF1EA}.exe
{F1B3209E-7406-4ab5-A45A-4303691F2810}.exe
{F2B25C83-812E-486f-A5E9-C3E785A54337}.exe