stormser | 6f23cfa4947d0d3f1a11e66896043ae859026a6911b30f3690972678e87cb791

General

Target
2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe
Size 167KB
Sample260628-18d91afs9s
SHA256 6f23cfa4947d0d3f1a11e66896043ae859026a6911b30f3690972678e87cb791
MD5 5de27b78b81ceaf8c28c9f0590744712
SHA1 e54fd99b97f10ca8cacb10b0ef7208a2126b7e89
SHA512 99b23f1a43b9ee78ad0690331b84f40bb7cb533137c152df425d1f8d83ba5f74449132fbe5ed5fadcf78ce69d7d61580f3865d301da603e82592443c19efa96c
SSDEEP 384:4/bLwOs8AHsc4sMfwhKQLro2c4/CFsrd:Wvw9816vhKQLroD4/wQ
TLSH
T185F308834BEE5CF3F791113109798AB9927B99C4910EBEEF6F90CD65007B292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral2/files/0x00080000000167e6-3.dat	family_stormser
behavioral2/files/0x000d00000001c554-6.dat	family_stormser
behavioral2/files/0x000c00000001c557-13.dat	family_stormser
behavioral2/files/0x000e00000001c554-19.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8302A1C2-EF93-4ce6-AEB0-027306206BAB}\stubpath = "C:\\Windows\\{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe"	{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61375C21-0FDA-423c-ABB8-061DD06F1435}	{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{61375C21-0FDA-423c-ABB8-061DD06F1435}\stubpath = "C:\\Windows\\{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe"	{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{14891FE4-E941-4227-A0CA-86C72C8A459B}	{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{14891FE4-E941-4227-A0CA-86C72C8A459B}\stubpath = "C:\\Windows\\{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe"	{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}	2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}\stubpath = "C:\\Windows\\{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe"	2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8302A1C2-EF93-4ce6-AEB0-027306206BAB}	{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe

Executes dropped EXE 5 IoCs

pid	Process
1364	{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe
5316	{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
2272	{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
3996	{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe
1796	{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe	{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
File created	C:\Windows\{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe	{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
File created	C:\Windows\{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe	2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe
File created	C:\Windows\{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe	{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{76B7446F-4C42-4A52-B7CA-3C026926A82E}	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3236	2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1364	{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe
Token: SeIncBasePriorityPrivilege	5316	{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
Token: SeIncBasePriorityPrivilege	2272	{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
Token: SeShutdownPrivilege	4888	explorer.exe
Token: SeCreatePagefilePrivilege	4888	explorer.exe
Token: SeShutdownPrivilege	4888	explorer.exe
Token: SeCreatePagefilePrivilege	4888	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3316	sihost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 1364	3236	2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe	89
PID 3236 wrote to memory of 1324	3236	2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe	90
PID 1364 wrote to memory of 5316	1364	{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe	91
PID 1364 wrote to memory of 5320	1364	{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe	92
PID 5316 wrote to memory of 2272	5316	{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe	94
PID 5316 wrote to memory of 1360	5316	{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe	95
PID 2272 wrote to memory of 3996	2272	{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe	96
PID 2272 wrote to memory of 2348	2272	{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe	97
PID 3316 wrote to memory of 4888	3316	sihost.exe	102
PID 4888 wrote to memory of 1796	4888	explorer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5de27b78b81ceaf8c28c9f0590744712_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe
  C:\Windows\{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
    C:\Windows\{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\Windows\{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
      C:\Windows\{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2272
    - - C:\Windows\{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe
        
        C:\Windows\{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3996
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{61375~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8302A~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{EDA35~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1324

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe
    "C:\Windows\{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe

Path C:\Windows\{14891FE4-E941-4227-A0CA-86C72C8A459B}.exe
Size 167KB
SHA256 12ccd3db13bc65826d64f399c6367f91e3bb672682689f2497faf6ce1c473cc7
MD5 3739bfb277bd85740210242a31a85959
SHA1 3924e0b4f3a59d4b256898991adb935261a82adb
SHA512 831b5561807a4f96371dc293dd9455a36a047e6b7284ac9a1090e8d7ecd43ae387f6caf3197ecaac5055f9cf46ff26a62574af0ce01eb29dbb428d56c27479d7
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwT0E4/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLroT4/CFsrd
TLSH
T13EF319834BDE5CF3F791113108798AB9927B99C4910EBEEF6F90CD650077292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe

Path C:\Windows\{61375C21-0FDA-423c-ABB8-061DD06F1435}.exe
Size 167KB
SHA256 bfcdd92019c8df4861e8c060b71f00bcbc9fc0a87101722a7fe7922ff7db71ac
MD5 92926e4894b76c2a83775b37e42dcbc0
SHA1 9e04ede2ad924c259f7d54ba1756b4dfbf26921a
SHA512 65072ab70b1b09c1f3c8115abd3c83515f55e5aebc7e353385014012406ebe0a47f393e5a6e4a778e1b809a53c455f29024407286e163df8d1b93c2742d93a18
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwc0E4/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLrog4/CFsrd
TLSH
T18AF308834BEE58F3F791113109798AB9927B99C4910EBEEB7F90CD65007B292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe

Path C:\Windows\{8302A1C2-EF93-4ce6-AEB0-027306206BAB}.exe
Size 167KB
SHA256 456ddcd46291c6113e455f09e0ce22509afe1e755cc335e6008092d78ee9cd67
MD5 e0eb68d21fa9dd2556b035b9bdba8a36
SHA1 1e33df4e4bc16cead7094c55425ba223370ddf9f
SHA512 3cce6dbdbbaece47ae16beb6884ad627f6ec48fe5a2531aabb847092a1423ad28e4d7d21ebf884fe68a7d5c21b8837a4070272185e86d31feb31f39672363e39
SSDEEP 384:4/bLwOs8AHsc4sMfwhKQLro5m4/CFsrd:Wvw9816vhKQLro5m4/wQ
TLSH
T1B4F318834BEE5CF3F791113109798AB9927B99C4910EBEEB7F90CD65007B292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe

Path C:\Windows\{EDA350E3-44BB-43e9-9505-E75F7F6CB0E6}.exe
Size 167KB
SHA256 12f56b3b79986b52fc6d565bf85647df7a80ce57d53654f675acfc240b78af23
MD5 0b6c9a06cd8dcf98063149e80176ba32
SHA1 3c161dab1164f338c77b6ec2b0a439cf3b9516fc
SHA512 511048da2b9611b48ff3b0a1b55f85c0eb9616364dea46c34172d61165fab05b990dc5ab991f2acf2f0d25c09d277b89bd9252d329d885af1d169a103a597bba
SSDEEP 192:4/bOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwQ0E4/CFxyNhoy5t:4/bLwOs8AHsc4sMfwhKQLros4/CFsrd
TLSH
T162F318834BEE5CF3F791113118798AB9927B99C4910EBEEB6F90CD65007B292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads