Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
06/10/2026, 18:12
General
- Target 2026-10-05_a1a1694eb038f03e126aff48ee847db3_elex_goldeneye_wannacry.exe
- Size 197KB
- Sample261006-wtbs4sszhy
- SHA256 0da0eb78937c9e6d31684132f13014e7a28ee91bac3407abea17dd0551c05003
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-05_a1a1694eb038f03e126aff48ee847db3_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-05_a1a1694eb038f03e126aff48ee847db3_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{34AF1186-4501-4436-B6FA-8AF0AEFFD83C}.exeC:\Windows\{34AF1186-4501-4436-B6FA-8AF0AEFFD83C}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{49758AF3-E8D8-426d-B020-79A37FFA6140}.exeC:\Windows\{49758AF3-E8D8-426d-B020-79A37FFA6140}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{18360E05-D70D-4222-A44B-025193F7A5EC}.exeC:\Windows\{18360E05-D70D-4222-A44B-025193F7A5EC}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{8004915F-B92F-45b8-A62D-9A06ED69EF03}.exeC:\Windows\{8004915F-B92F-45b8-A62D-9A06ED69EF03}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{DEF82FC8-2C43-47af-AB75-BDE09241D990}.exeC:\Windows\{DEF82FC8-2C43-47af-AB75-BDE09241D990}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F20EA77-5208-406c-AB7C-2FCF010E33AF}.exeC:\Windows\{4F20EA77-5208-406c-AB7C-2FCF010E33AF}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{9D6248D9-71FC-49b9-ACBE-4946B46FE30F}.exeC:\Windows\{9D6248D9-71FC-49b9-ACBE-4946B46FE30F}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{C31CD93B-029A-48da-A029-982001D91D10}.exeC:\Windows\{C31CD93B-029A-48da-A029-982001D91D10}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{79526FB8-6C06-4d53-893C-A8F4AB2E42C6}.exeC:\Windows\{79526FB8-6C06-4d53-893C-A8F4AB2E42C6}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{1D154DC5-F12C-4a14-B9D6-502F9FC20852}.exeC:\Windows\{1D154DC5-F12C-4a14-B9D6-502F9FC20852}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{4F2AD5D8-01B8-4d50-AC9D-ECF2B0219778}.exeC:\Windows\{4F2AD5D8-01B8-4d50-AC9D-ECF2B0219778}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{1D154~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{79526~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{C31CD~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{9D624~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{4F20E~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{DEF82~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{80049~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{18360~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{49758~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{34AF1~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{18360E05-D70D-4222-A44B-025193F7A5EC}.exe
{1D154DC5-F12C-4a14-B9D6-502F9FC20852}.exe
{34AF1186-4501-4436-B6FA-8AF0AEFFD83C}.exe
{49758AF3-E8D8-426d-B020-79A37FFA6140}.exe
{4F20EA77-5208-406c-AB7C-2FCF010E33AF}.exe
{4F2AD5D8-01B8-4d50-AC9D-ECF2B0219778}.exe
{79526FB8-6C06-4d53-893C-A8F4AB2E42C6}.exe
{8004915F-B92F-45b8-A62D-9A06ED69EF03}.exe
{9D6248D9-71FC-49b9-ACBE-4946B46FE30F}.exe
{C31CD93B-029A-48da-A029-982001D91D10}.exe
{DEF82FC8-2C43-47af-AB75-BDE09241D990}.exe