Analysis
- max time kernel
149s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
30/09/2026, 11:16
General
- Target 2026-09-30_5896a5c41e42858754a7089a7b3707bb_elex_goldeneye_wannacry.exe
- Size 204KB
- Sample260930-nddnrssgmh
- SHA256 d3a5a732515f1be8668a8e2ec067bf7e7e6f3f6149d990b0a7b408bd9bcd2d2b
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_5896a5c41e42858754a7089a7b3707bb_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_5896a5c41e42858754a7089a7b3707bb_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{0E872A1C-A61E-42aa-9024-076FCE80D108}.exeC:\Windows\{0E872A1C-A61E-42aa-9024-076FCE80D108}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F2CFD402-CF76-4762-83AF-39E9E60C0D3E}.exeC:\Windows\{F2CFD402-CF76-4762-83AF-39E9E60C0D3E}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C4ED2ABB-CCF2-45c1-8905-BB6ECDBF8F0E}.exeC:\Windows\{C4ED2ABB-CCF2-45c1-8905-BB6ECDBF8F0E}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F7116776-6C30-4c55-8B19-5CE83A2D8B0B}.exeC:\Windows\{F7116776-6C30-4c55-8B19-5CE83A2D8B0B}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1A5302A2-43BD-4a45-915F-53D7A2205E8A}.exeC:\Windows\{1A5302A2-43BD-4a45-915F-53D7A2205E8A}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{ED90DF33-B5A1-4930-AA0B-1ABD20C277ED}.exeC:\Windows\{ED90DF33-B5A1-4930-AA0B-1ABD20C277ED}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{65712420-953A-43fb-93FC-EE97C17C14E0}.exeC:\Windows\{65712420-953A-43fb-93FC-EE97C17C14E0}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1B4CDBE3-8E04-433f-B876-937443BAAF2C}.exeC:\Windows\{1B4CDBE3-8E04-433f-B876-937443BAAF2C}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{203E6C18-D885-4128-B497-5E33510FEF74}.exeC:\Windows\{203E6C18-D885-4128-B497-5E33510FEF74}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{807DDE14-CEE7-46f8-9C47-FC32AD624236}.exeC:\Windows\{807DDE14-CEE7-46f8-9C47-FC32AD624236}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A0EA7B1A-A6F9-4c40-9F80-E1219AFD5CC4}.exeC:\Windows\{A0EA7B1A-A6F9-4c40-9F80-E1219AFD5CC4}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{807DD~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{203E6~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1B4CD~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{65712~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{ED90D~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1A530~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F7116~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C4ED2~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F2CFD~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{0E872~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{0E872A1C-A61E-42aa-9024-076FCE80D108}.exe
{1A5302A2-43BD-4a45-915F-53D7A2205E8A}.exe
{1B4CDBE3-8E04-433f-B876-937443BAAF2C}.exe
{203E6C18-D885-4128-B497-5E33510FEF74}.exe
{65712420-953A-43fb-93FC-EE97C17C14E0}.exe
{807DDE14-CEE7-46f8-9C47-FC32AD624236}.exe
{A0EA7B1A-A6F9-4c40-9F80-E1219AFD5CC4}.exe
{C4ED2ABB-CCF2-45c1-8905-BB6ECDBF8F0E}.exe
{ED90DF33-B5A1-4930-AA0B-1ABD20C277ED}.exe
{F2CFD402-CF76-4762-83AF-39E9E60C0D3E}.exe
{F7116776-6C30-4c55-8B19-5CE83A2D8B0B}.exe