Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/07/2026, 00:21
General
- Target 2026-07-28_cddac51c1b29ea4c2151145b07420c3f_elex_goldeneye_wannacry.exe
- Size 372KB
- Sample260729-ancybscq91
- SHA256 7ee79d788701873802c96583a144cbf204eb65bc1c0ed1dc6f571ca9db887a01
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_cddac51c1b29ea4c2151145b07420c3f_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_cddac51c1b29ea4c2151145b07420c3f_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BEDD5DB6-903B-441c-B3CF-F778002C9FFD}.exeC:\Windows\{BEDD5DB6-903B-441c-B3CF-F778002C9FFD}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1697417C-2447-400a-874C-14B01F286A1B}.exeC:\Windows\{1697417C-2447-400a-874C-14B01F286A1B}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3B4B3C30-039D-4fb4-A0C1-092B9B63C952}.exeC:\Windows\{3B4B3C30-039D-4fb4-A0C1-092B9B63C952}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7A8B364A-ECD5-4ec1-AC51-BB063FA5E908}.exeC:\Windows\{7A8B364A-ECD5-4ec1-AC51-BB063FA5E908}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A38D9BFF-6912-4264-BC06-09A4CE1B6F6C}.exeC:\Windows\{A38D9BFF-6912-4264-BC06-09A4CE1B6F6C}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A1ABE5B0-73D0-490d-9ACB-C9F70CFD9FDF}.exeC:\Windows\{A1ABE5B0-73D0-490d-9ACB-C9F70CFD9FDF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{74180ADB-6635-4c14-893B-B7F8AAF28A94}.exeC:\Windows\{74180ADB-6635-4c14-893B-B7F8AAF28A94}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{48F39842-DD85-410c-AED8-151F6A373585}.exeC:\Windows\{48F39842-DD85-410c-AED8-151F6A373585}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{50C0A854-29C7-4a38-B506-703A6DA0BE6F}.exeC:\Windows\{50C0A854-29C7-4a38-B506-703A6DA0BE6F}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{2733301F-33B7-402f-8359-82F353DAB9CD}.exeC:\Windows\{2733301F-33B7-402f-8359-82F353DAB9CD}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B7F8C86A-8B65-4a65-9F1D-4A8960235ECF}.exeC:\Windows\{B7F8C86A-8B65-4a65-9F1D-4A8960235ECF}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{27333~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{50C0A~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{48F39~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{74180~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A1ABE~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A38D9~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7A8B3~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3B4B3~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16974~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BEDD5~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{1697417C-2447-400a-874C-14B01F286A1B}.exe
{2733301F-33B7-402f-8359-82F353DAB9CD}.exe
{3B4B3C30-039D-4fb4-A0C1-092B9B63C952}.exe
{48F39842-DD85-410c-AED8-151F6A373585}.exe
{50C0A854-29C7-4a38-B506-703A6DA0BE6F}.exe
{74180ADB-6635-4c14-893B-B7F8AAF28A94}.exe
{7A8B364A-ECD5-4ec1-AC51-BB063FA5E908}.exe
{A1ABE5B0-73D0-490d-9ACB-C9F70CFD9FDF}.exe
{A38D9BFF-6912-4264-BC06-09A4CE1B6F6C}.exe
{B7F8C86A-8B65-4a65-9F1D-4A8960235ECF}.exe
{BEDD5DB6-903B-441c-B3CF-F778002C9FFD}.exe