stormser | 9e7f1aef74488a1019839d82e0d817cdf728f145e33aa84e458b11d2c07d4f51

General

Target
2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe
Size 60KB
Sample260629-daaslabw6w
SHA256 9e7f1aef74488a1019839d82e0d817cdf728f145e33aa84e458b11d2c07d4f51
MD5 cd7cd6330edf83c8fe6f569c913a1591
SHA1 49d5485eada37d441b7e57d697ef303c3413aaf4
SHA512 698ba28260cfdd707177d4d3aa76556caa5077fef5a0e42ee053607fd888d5e713c446155b0b78ed5fd34835fa2ffab9eaeb0463f411367f18a9c217de9bb1fd
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwGCY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroG44/CFsrd
TLSH
T1FA5309834BDE9CF2F791123108794AB9927B9AC4910EBE9FBF90CD140037292E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c51e-3.dat	family_stormser
behavioral2/files/0x000d00000001c51f-6.dat	family_stormser
behavioral2/files/0x000f00000001c51e-13.dat	family_stormser
behavioral2/files/0x000e00000001c51f-18.dat	family_stormser
behavioral2/files/0x001000000001c51e-23.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}	{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}	{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}\stubpath = "C:\\Windows\\{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe"	{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}\stubpath = "C:\\Windows\\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe"	{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{912360AA-5444-4964-9E38-45BD0C1E4070}\stubpath = "C:\\Windows\\{912360AA-5444-4964-9E38-45BD0C1E4070}.exe"	2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B333D1B6-5455-494f-8F77-9E265B52207B}	{912360AA-5444-4964-9E38-45BD0C1E4070}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B333D1B6-5455-494f-8F77-9E265B52207B}\stubpath = "C:\\Windows\\{B333D1B6-5455-494f-8F77-9E265B52207B}.exe"	{912360AA-5444-4964-9E38-45BD0C1E4070}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}\stubpath = "C:\\Windows\\{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe"	{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}	{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{912360AA-5444-4964-9E38-45BD0C1E4070}	2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe

Executes dropped EXE 6 IoCs

pid	Process
1416	{912360AA-5444-4964-9E38-45BD0C1E4070}.exe
2484	{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
4904	{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
4504	{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
2956	{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe
6084	{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe	{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
File created	C:\Windows\{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe	{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
File created	C:\Windows\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe	{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
File created	C:\Windows\{912360AA-5444-4964-9E38-45BD0C1E4070}.exe	2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe
File created	C:\Windows\{B333D1B6-5455-494f-8F77-9E265B52207B}.exe	{912360AA-5444-4964-9E38-45BD0C1E4070}.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{912360AA-5444-4964-9E38-45BD0C1E4070}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{09A75AB5-D344-4CD9-9644-0CA1DFBFF2EC}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3600	2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1416	{912360AA-5444-4964-9E38-45BD0C1E4070}.exe
Token: SeIncBasePriorityPrivilege	2484	{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
Token: SeIncBasePriorityPrivilege	4904	{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
Token: SeIncBasePriorityPrivilege	4504	{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
Token: SeShutdownPrivilege	3436	explorer.exe
Token: SeCreatePagefilePrivilege	3436	explorer.exe
Token: SeShutdownPrivilege	3436	explorer.exe
Token: SeCreatePagefilePrivilege	3436	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4568	sihost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 1416	3600	2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe	89
PID 3600 wrote to memory of 5660	3600	2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe	90
PID 1416 wrote to memory of 2484	1416	{912360AA-5444-4964-9E38-45BD0C1E4070}.exe	91
PID 1416 wrote to memory of 4496	1416	{912360AA-5444-4964-9E38-45BD0C1E4070}.exe	92
PID 2484 wrote to memory of 4904	2484	{B333D1B6-5455-494f-8F77-9E265B52207B}.exe	93
PID 2484 wrote to memory of 4852	2484	{B333D1B6-5455-494f-8F77-9E265B52207B}.exe	94
PID 4904 wrote to memory of 4504	4904	{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe	95
PID 4904 wrote to memory of 5212	4904	{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe	96
PID 4504 wrote to memory of 2956	4504	{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe	97
PID 4504 wrote to memory of 4200	4504	{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe	98
PID 4568 wrote to memory of 3436	4568	sihost.exe	103
PID 3436 wrote to memory of 6084	3436	explorer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_cd7cd6330edf83c8fe6f569c913a1591_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\{912360AA-5444-4964-9E38-45BD0C1E4070}.exe
  C:\Windows\{912360AA-5444-4964-9E38-45BD0C1E4070}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1416
- - C:\Windows\{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
    C:\Windows\{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
      C:\Windows\{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Windows\{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
        
        C:\Windows\{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4504
      - C:\Windows\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe
        
        C:\Windows\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2956
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{79DA9~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4200
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{BF597~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B333D~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{91236~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4496
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5660

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe
    "C:\Windows\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe

Path C:\Windows\{79DA9B27-BFC2-4057-9DA7-4D35FDAAD6E6}.exe
Size 60KB
SHA256 1386fb6ffc251e6865beb7a76290bbe8db763a24ba07691544048b80ed7cfc78
MD5 24bc9736fbe91f72cfcdd0262113af47
SHA1 f6387b9f975ac22e65559be1a2b0cf887cfb74ca
SHA512 af59ddc87090268392afc92ba5e3fafe6ac57c993af415c024c6220a2855f5b1833df11da7d1c112de7c4fa0d8da49f25ecc43afb5da3dbcdf56dbf4f3e18a65
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwOY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLro04/CFsrd
TLSH
T15B5309834BDE5CF2F791127108794AB9927B9AD4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{912360AA-5444-4964-9E38-45BD0C1E4070}.exe

Path C:\Windows\{912360AA-5444-4964-9E38-45BD0C1E4070}.exe
Size 60KB
SHA256 5c370c751e912f6037e213765be7adafc036579157ee07fab6292cebdebe5f8b
MD5 3baa2890d3fc842b6a380c3205e34962
SHA1 c37743d54723cf0d15cdf4dd9df0e198aed7f76a
SHA512 85af4b4589aa694769fca67f3874c3c236fa9b4f30291875591a5944dbd153acdbfd7e40c366a02a96bae9f0b8091aaacd544c877e1914eec7580264ca180e70
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwDY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroF4/CFsrd
TLSH
T1AA5309834BDE9CF2F791127108794AB9927B99D4910EBE9FBF90CD140037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B333D1B6-5455-494f-8F77-9E265B52207B}.exe

Path C:\Windows\{B333D1B6-5455-494f-8F77-9E265B52207B}.exe
Size 60KB
SHA256 cebca281a366f3c8f994020210c3ed462e7fdaecf7b84a0c46f6507610e6de0a
MD5 97381e77ca191dc113b39ebcccf6a55c
SHA1 68b4617bfccec4555005d7109424a9ff81368e3c
SHA512 513644a47c87508a63301ac122c859d7670b173a775b091afac5f14015a13c2bf03b90283b778d2bc56ffebafee43ce970fc33da7d96092e2513e0c298c2fbfa
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwZY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLror4/CFsrd
TLSH
T1305309834BDE5CF2F795123108794AB9927B9AC4910EBE9FBF90CE540037692E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe

Path C:\Windows\{BF597E0D-1ADD-4bf5-A01A-A4A3F9313727}.exe
Size 60KB
SHA256 a69b530a806aa030e9455c6852f9f39e86895387de310492f5a205a8772cce8c
MD5 cefaed48ee3c8314107efb204bde8c58
SHA1 eaef67ddf154b8d644d4114e8503fc319a4417ab
SHA512 b5fce1f7ecdca37da831452767303e283419db673835897d42ccbec7e9564ea3a14848b7aec5a2bafd5a7a85ffc653a112f7ad7e6ca5a13af13c6433d2872f9d
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwRJZY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroTr4/CFsrd
TLSH
T1115309834BDE5CF2F791123108794AB9927B9AC4910EBE9FBF90CD140037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe

Path C:\Windows\{EC2ABA3D-0D35-43ec-8CCF-4288365909D1}.exe
Size 60KB
SHA256 ea9145479b5c96bf161f6de99b12523688b3981bc140e74059bb73ee9a64fcc8
MD5 cab29efb05941c68c824136481f9d336
SHA1 f3a1c6929ad77a0148f1bd8a3a64d001fa3235c6
SHA512 6827051561b9c731574f239437d1b1fff545dd91d8fd48fc8bc116a69090b3e034f3b300465b320c8e3cb7875e0b6ea5723c6fcbd1d4204f0e6d66ed15112277
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwZY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLror4/CFsrd
TLSH
T14B5309834BDE9CF2F791123108794AB9927B9AC4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads