stormser | 887b73e5e263c34f69614058cde17c80582b4336387230d453ea49b7956ca776

General

Target
2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe
Size 60KB
Sample260629-bstbjsat21
SHA256 887b73e5e263c34f69614058cde17c80582b4336387230d453ea49b7956ca776
MD5 f2b2517c1e5ae3814583dfdb4a3c4c6d
SHA1 d28cf99d17bb3195ddc9a1db504773c6fe863301
SHA512 071eb63e2ae5f3c7051fe981e5ee4fba9bef97799f6cf0ee91072af6acf4a5f587c37e154b7e1c813a1c7407fc7cdff210a6f4dbe9717639b7dc4b4f6214bcba
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwQY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLro+4/CFsrd
TLSH
T1775309834BDE9CF2F791127108794AB9927B9AC4910EBE9FBF90CD540037292E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000167e6-3.dat	family_stormser
behavioral2/files/0x000e00000001c45b-6.dat	family_stormser
behavioral2/files/0x000d00000001c45e-13.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4E5804C-6F4B-42fb-B362-A2F709545BA4}	2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F4E5804C-6F4B-42fb-B362-A2F709545BA4}\stubpath = "C:\\Windows\\{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe"	2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0EE441A-AE5D-4ca3-8C0E-36402754C265}	{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A0EE441A-AE5D-4ca3-8C0E-36402754C265}\stubpath = "C:\\Windows\\{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe"	{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{726257C6-071F-4b49-A738-31036B3A324D}	{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{726257C6-071F-4b49-A738-31036B3A324D}\stubpath = "C:\\Windows\\{726257C6-071F-4b49-A738-31036B3A324D}.exe"	{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe

Executes dropped EXE 4 IoCs

pid	Process
1416	{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
4748	{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe
2736	{726257C6-071F-4b49-A738-31036B3A324D}.exe
4764	{726257C6-071F-4b49-A738-31036B3A324D}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe	2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe
File created	C:\Windows\{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe	{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
File created	C:\Windows\{726257C6-071F-4b49-A738-31036B3A324D}.exe	{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{726257C6-071F-4b49-A738-31036B3A324D}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{726257C6-071F-4b49-A738-31036B3A324D}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{57635AF8-F2E8-46C3-9AEF-08C35B970F98}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1772	2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1416	{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
Token: SeIncBasePriorityPrivilege	4748	{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe
Token: SeShutdownPrivilege	1936	explorer.exe
Token: SeCreatePagefilePrivilege	1936	explorer.exe
Token: SeShutdownPrivilege	1936	explorer.exe
Token: SeCreatePagefilePrivilege	1936	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2324	sihost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1416	1772	2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe	89
PID 1772 wrote to memory of 2276	1772	2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe	90
PID 1416 wrote to memory of 4748	1416	{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe	91
PID 1416 wrote to memory of 5360	1416	{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe	92
PID 4748 wrote to memory of 2736	4748	{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe	94
PID 4748 wrote to memory of 2448	4748	{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe	95
PID 2324 wrote to memory of 1936	2324	sihost.exe	100
PID 1936 wrote to memory of 4764	1936	explorer.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_f2b2517c1e5ae3814583dfdb4a3c4c6d_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
  C:\Windows\{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe
    C:\Windows\{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\{726257C6-071F-4b49-A738-31036B3A324D}.exe
      C:\Windows\{726257C6-071F-4b49-A738-31036B3A324D}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2736
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A0EE4~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F4E58~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2276

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\{726257C6-071F-4b49-A738-31036B3A324D}.exe
    "C:\Windows\{726257C6-071F-4b49-A738-31036B3A324D}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{726257C6-071F-4b49-A738-31036B3A324D}.exe

Path C:\Windows\{726257C6-071F-4b49-A738-31036B3A324D}.exe
Size 60KB
SHA256 01ce9213e24febdcb58a4ec2f356d21c5a090746397e413c4c3242db9a976acd
MD5 0360ca993a4f5ff18c5da8a6cccde18c
SHA1 c2e4d784e19e9c1b71f0e09d32615ffbac04272c
SHA512 88fd32e696154f4269bbfaf69327860b464e7ade681c718f8d58f7c75c7927552fb57b1c7e755b30d57b5c1e754fe439c817fcaa863e94aa673d90afc870e9b5
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwGNY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroY4/CFsrd
TLSH
T1C15309834BDE5CF2F791123108794AB9927B9AC4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe

Path C:\Windows\{A0EE441A-AE5D-4ca3-8C0E-36402754C265}.exe
Size 60KB
SHA256 05825d35d17cd0f8beb8f7e880dc522b2068fc7a8a4921567e31bdc46e4b6a20
MD5 e226e7b892f6877756ae951cc9bb7bce
SHA1 638fb828aebc89385e6e71f6a31170fe8ed17499
SHA512 ea0259aade2a98ab95cab3644cf48e3d9fcd1b05a5013104e9be4092941fdc4fe367fcb57550fe016da6c670055cda32113677a3c5f3e265b33eb482a7a070df
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwIY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroW4/CFsrd
TLSH
T12E5309834BDE5CF2F791123108794AB9927B9AC4910EBE9FBF90CE140037692E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe

Path C:\Windows\{F4E5804C-6F4B-42fb-B362-A2F709545BA4}.exe
Size 60KB
SHA256 6c03d6a0f6196dba45b7a2eab81fb843a9140f1458a67fb3dea6aa239d3c5199
MD5 c4c20b5899b32498f77f453f311155d1
SHA1 c24f8b90720c43dddd0376ad83c2f03819e0bb28
SHA512 609088b08de4f71798ddb6c220d8cca935c357e61b1a8c41c984c5eda7e8f103a386410374abea6f862e7fd7f01fcf0d8d6b386633922ffcf464022173d84829
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw4Y04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLrom4/CFsrd
TLSH
T1A65309834BDE5CF2F791123118794AB9927B9AC4910EBE9FBF90CD544037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads