Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
15/07/2026, 15:37
General
- Target 2026-07-15_51d5e1bce6cb9798140bac9730d41792_elex_goldeneye_wannacry.exe
- Size 344KB
- Sample260715-s2nwvsfx2r
- SHA256 37b08af252e579bc6da4718afca8531450fb3afe2334dcd5807485873d047275
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_51d5e1bce6cb9798140bac9730d41792_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_51d5e1bce6cb9798140bac9730d41792_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{81C17B48-2F51-4dcc-B806-B070B8169C35}.exeC:\Windows\{81C17B48-2F51-4dcc-B806-B070B8169C35}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{099248DE-D097-4ddd-AF11-51C3B9F8CD49}.exeC:\Windows\{099248DE-D097-4ddd-AF11-51C3B9F8CD49}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3EDA01DE-3531-4616-B53D-885CCEDCE424}.exeC:\Windows\{3EDA01DE-3531-4616-B53D-885CCEDCE424}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0903B471-790B-4309-BE98-53FA86AC472C}.exeC:\Windows\{0903B471-790B-4309-BE98-53FA86AC472C}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{73496060-EC98-4f42-9D92-8C8D5CDC5DCA}.exeC:\Windows\{73496060-EC98-4f42-9D92-8C8D5CDC5DCA}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D2E1CE5-0B51-44d6-A749-3FA9314BBDEA}.exeC:\Windows\{9D2E1CE5-0B51-44d6-A749-3FA9314BBDEA}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{24205F24-E238-4cba-9DA0-8923A9A119A1}.exeC:\Windows\{24205F24-E238-4cba-9DA0-8923A9A119A1}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ABBC5540-D398-4c02-AE64-503755D9913F}.exeC:\Windows\{ABBC5540-D398-4c02-AE64-503755D9913F}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4581338A-2FCD-426f-9BA5-81A19D97CDC9}.exeC:\Windows\{4581338A-2FCD-426f-9BA5-81A19D97CDC9}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C3F5B69D-03BC-4011-831F-C62AD78D8681}.exeC:\Windows\{C3F5B69D-03BC-4011-831F-C62AD78D8681}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F93B538A-9977-44cc-A363-BFA16E0F9660}.exeC:\Windows\{F93B538A-9977-44cc-A363-BFA16E0F9660}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C3F5B~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{45813~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ABBC5~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{24205~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D2E1~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{73496~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0903B~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3EDA0~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{09924~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{81C17~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0903B471-790B-4309-BE98-53FA86AC472C}.exe
{099248DE-D097-4ddd-AF11-51C3B9F8CD49}.exe
{24205F24-E238-4cba-9DA0-8923A9A119A1}.exe
{3EDA01DE-3531-4616-B53D-885CCEDCE424}.exe
{4581338A-2FCD-426f-9BA5-81A19D97CDC9}.exe
{73496060-EC98-4f42-9D92-8C8D5CDC5DCA}.exe
{81C17B48-2F51-4dcc-B806-B070B8169C35}.exe
{9D2E1CE5-0B51-44d6-A749-3FA9314BBDEA}.exe
{ABBC5540-D398-4c02-AE64-503755D9913F}.exe
{C3F5B69D-03BC-4011-831F-C62AD78D8681}.exe
{F93B538A-9977-44cc-A363-BFA16E0F9660}.exe