Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
30/07/2026, 04:57
General
- Target 2026-07-30_c984123ae5b57ff1342fb81ec7c08fef_elex_goldeneye_wannacry.exe
- Size 168KB
- Sample260730-fla9lszdpd
- SHA256 a849a7a41d527dc989df7bd77220c2612cac65c8df5ef937305d48c5800642b6
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_c984123ae5b57ff1342fb81ec7c08fef_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_c984123ae5b57ff1342fb81ec7c08fef_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1DDBADCA-2E8D-4eb5-B4CC-E422B8C1F68E}.exeC:\Windows\{1DDBADCA-2E8D-4eb5-B4CC-E422B8C1F68E}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{3BB8C62E-27F1-4060-9C7F-59C1C1B89E41}.exeC:\Windows\{3BB8C62E-27F1-4060-9C7F-59C1C1B89E41}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{7436EFB1-BFEE-46d0-8A76-56254F5B4594}.exeC:\Windows\{7436EFB1-BFEE-46d0-8A76-56254F5B4594}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{16D35706-00DD-45cd-AACE-B5AF330B7976}.exeC:\Windows\{16D35706-00DD-45cd-AACE-B5AF330B7976}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{FFAEB6EA-C8C0-40a2-A8E2-E6EB8CBED4F0}.exeC:\Windows\{FFAEB6EA-C8C0-40a2-A8E2-E6EB8CBED4F0}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{EB5BB005-75DE-48b9-9018-37F2CE2CB5D9}.exeC:\Windows\{EB5BB005-75DE-48b9-9018-37F2CE2CB5D9}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BB8ECB1C-E11F-4188-9D35-6A431E57FACB}.exeC:\Windows\{BB8ECB1C-E11F-4188-9D35-6A431E57FACB}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F04F3120-5863-4670-B1CF-2614E4C5592B}.exeC:\Windows\{F04F3120-5863-4670-B1CF-2614E4C5592B}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{03B19427-0E44-4436-B5E6-893E41958D52}.exeC:\Windows\{03B19427-0E44-4436-B5E6-893E41958D52}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A62E202A-24A8-4d59-9328-565B02572B37}.exeC:\Windows\{A62E202A-24A8-4d59-9328-565B02572B37}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49B054AC-21BB-4324-9680-5B411BADDB1C}.exeC:\Windows\{49B054AC-21BB-4324-9680-5B411BADDB1C}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A62E2~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{03B19~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F04F3~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BB8EC~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{EB5BB~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FFAEB~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{16D35~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{7436E~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BB8C~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1DDBA~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{03B19427-0E44-4436-B5E6-893E41958D52}.exe
{16D35706-00DD-45cd-AACE-B5AF330B7976}.exe
{1DDBADCA-2E8D-4eb5-B4CC-E422B8C1F68E}.exe
{3BB8C62E-27F1-4060-9C7F-59C1C1B89E41}.exe
{49B054AC-21BB-4324-9680-5B411BADDB1C}.exe
{7436EFB1-BFEE-46d0-8A76-56254F5B4594}.exe
{A62E202A-24A8-4d59-9328-565B02572B37}.exe
{BB8ECB1C-E11F-4188-9D35-6A431E57FACB}.exe
{EB5BB005-75DE-48b9-9018-37F2CE2CB5D9}.exe
{F04F3120-5863-4670-B1CF-2614E4C5592B}.exe
{FFAEB6EA-C8C0-40a2-A8E2-E6EB8CBED4F0}.exe