Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 07:56
General
- Target 2026-10-26_be5cf5f01728329c50810ca32f5787f5_elex_goldeneye_wannacry.exe
- Size 468KB
- Sample261027-js7g6sda55
- SHA256 ef0e64361d9b8e95a98db81dd8fbb0b70a2fa86333b88e0ebde46ad5a68bd535
Score
10/10
Malware Config
Signatures
- Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
- Detects Stormser aka Storm DDoS and StormAttack 11 IoCs
- Auto-generated rule 11 IoCs
- Detects Windows executables referencing Office macro registry keys. Observed modifying Office config 11 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 11 IoCs
- Drops file in Windows directory 11 IoCs
- Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 22 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-26_be5cf5f01728329c50810ca32f5787f5_elex_goldeneye_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-26_be5cf5f01728329c50810ca32f5787f5_elex_goldeneye_wannacry.exe"1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{92386B11-87B1-4698-BE88-082EB217DE45}.exeC:\Windows\{92386B11-87B1-4698-BE88-082EB217DE45}.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{B3202599-2A33-463b-AE53-317760C27073}.exeC:\Windows\{B3202599-2A33-463b-AE53-317760C27073}.exe3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{A200DD0F-A99F-43aa-8E7C-B447FC0B2346}.exeC:\Windows\{A200DD0F-A99F-43aa-8E7C-B447FC0B2346}.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{F5232E6E-8B2E-4b99-B013-0781834CEDF0}.exeC:\Windows\{F5232E6E-8B2E-4b99-B013-0781834CEDF0}.exe5⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{E8410BF8-FDE8-4f9f-8D48-F2CF5F9AA8BD}.exeC:\Windows\{E8410BF8-FDE8-4f9f-8D48-F2CF5F9AA8BD}.exe6⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{BBE59987-BDAB-44d9-AB17-A001F346D235}.exeC:\Windows\{BBE59987-BDAB-44d9-AB17-A001F346D235}.exe7⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{76F31B6C-4F23-4f4e-8E61-18A9807D1289}.exeC:\Windows\{76F31B6C-4F23-4f4e-8E61-18A9807D1289}.exe8⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{40AB87E0-8B3B-4bf1-9EF6-1D10F98F7D88}.exeC:\Windows\{40AB87E0-8B3B-4bf1-9EF6-1D10F98F7D88}.exe9⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{AE6A45D5-4980-47c0-897B-A02FFE273CAD}.exeC:\Windows\{AE6A45D5-4980-47c0-897B-A02FFE273CAD}.exe10⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{D8370B4A-FE6D-4619-88D8-92CCBF872D38}.exeC:\Windows\{D8370B4A-FE6D-4619-88D8-92CCBF872D38}.exe11⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\{CBBEFCBD-A86F-40ab-9E43-4D85A8E144F5}.exeC:\Windows\{CBBEFCBD-A86F-40ab-9E43-4D85A8E144F5}.exe12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{D8370~1.EXE > nul12⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{AE6A4~1.EXE > nul11⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{40AB8~1.EXE > nul10⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{76F31~1.EXE > nul9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BBE59~1.EXE > nul8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{E8410~1.EXE > nul7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F5232~1.EXE > nul6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{A200D~1.EXE > nul5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B3202~1.EXE > nul4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{92386~1.EXE > nul3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
{40AB87E0-8B3B-4bf1-9EF6-1D10F98F7D88}.exe
{76F31B6C-4F23-4f4e-8E61-18A9807D1289}.exe
{92386B11-87B1-4698-BE88-082EB217DE45}.exe
{A200DD0F-A99F-43aa-8E7C-B447FC0B2346}.exe
{AE6A45D5-4980-47c0-897B-A02FFE273CAD}.exe
{B3202599-2A33-463b-AE53-317760C27073}.exe
{BBE59987-BDAB-44d9-AB17-A001F346D235}.exe
{CBBEFCBD-A86F-40ab-9E43-4D85A8E144F5}.exe
{D8370B4A-FE6D-4619-88D8-92CCBF872D38}.exe
{E8410BF8-FDE8-4f9f-8D48-F2CF5F9AA8BD}.exe
{F5232E6E-8B2E-4b99-B013-0781834CEDF0}.exe