Analysis
- max time kernel
148s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
16/07/2026, 21:29
General
- Target 2026-07-16_49e133f2e69b747651fc2dd2df76a99e_elex_goldeneye_wannacry.exe
- Size 380KB
- Sample260716-1b7kaaev5m
- SHA256 538c0965d1eb5f39f429644a62ae0d828f1f259b38629349c0654ef466a9dbbd
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_49e133f2e69b747651fc2dd2df76a99e_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_49e133f2e69b747651fc2dd2df76a99e_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{987B2EB3-D1DC-4eb2-90A6-C3F444F31573}.exeC:\Windows\{987B2EB3-D1DC-4eb2-90A6-C3F444F31573}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0883B5C6-7C3B-4d79-870D-76463B4DE65C}.exeC:\Windows\{0883B5C6-7C3B-4d79-870D-76463B4DE65C}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E7BBFC9E-DAC7-479c-B6E9-C51A5C14748C}.exeC:\Windows\{E7BBFC9E-DAC7-479c-B6E9-C51A5C14748C}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0285AF37-8173-4c7f-B502-3F88F2FAE0F0}.exeC:\Windows\{0285AF37-8173-4c7f-B502-3F88F2FAE0F0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F73EB33C-B329-4278-9EA5-7F24E4F0C781}.exeC:\Windows\{F73EB33C-B329-4278-9EA5-7F24E4F0C781}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CF5FFF11-5E0A-40f3-A721-ECD77B55AEFB}.exeC:\Windows\{CF5FFF11-5E0A-40f3-A721-ECD77B55AEFB}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{790DDECF-442A-42b6-AFB5-14DE53BA9F09}.exeC:\Windows\{790DDECF-442A-42b6-AFB5-14DE53BA9F09}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34F74AC3-2A1F-49cf-9533-CB260A0B91B2}.exeC:\Windows\{34F74AC3-2A1F-49cf-9533-CB260A0B91B2}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{947DF486-7D0A-4c96-85C2-849BE1D64D3D}.exeC:\Windows\{947DF486-7D0A-4c96-85C2-849BE1D64D3D}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2EF503D2-B5C2-4bc8-9887-702D88BB4DFC}.exeC:\Windows\{2EF503D2-B5C2-4bc8-9887-702D88BB4DFC}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AA205D6B-5661-4250-A939-1D02F8064BDE}.exeC:\Windows\{AA205D6B-5661-4250-A939-1D02F8064BDE}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2EF50~1.EXE > nul12⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{947DF~1.EXE > nul11⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34F74~1.EXE > nul10⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{790DD~1.EXE > nul9⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{CF5FF~1.EXE > nul8⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F73EB~1.EXE > nul7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0285A~1.EXE > nul6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E7BBF~1.EXE > nul5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0883B~1.EXE > nul4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{987B2~1.EXE > nul3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0285AF37-8173-4c7f-B502-3F88F2FAE0F0}.exe
{0883B5C6-7C3B-4d79-870D-76463B4DE65C}.exe
{2EF503D2-B5C2-4bc8-9887-702D88BB4DFC}.exe
{34F74AC3-2A1F-49cf-9533-CB260A0B91B2}.exe
{790DDECF-442A-42b6-AFB5-14DE53BA9F09}.exe
{947DF486-7D0A-4c96-85C2-849BE1D64D3D}.exe
{987B2EB3-D1DC-4eb2-90A6-C3F444F31573}.exe
{AA205D6B-5661-4250-A939-1D02F8064BDE}.exe
{CF5FFF11-5E0A-40f3-A721-ECD77B55AEFB}.exe
{E7BBFC9E-DAC7-479c-B6E9-C51A5C14748C}.exe
{F73EB33C-B329-4278-9EA5-7F24E4F0C781}.exe