stormser | 9587f8c33769829fc1b430584d96b0c138f76cb00f4ef24e8a007eefd3930698

General

Target
2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe
Size 468KB
Sample260702-wbd6hsgs2l
SHA256 9587f8c33769829fc1b430584d96b0c138f76cb00f4ef24e8a007eefd3930698
MD5 4fc556c50bee7fb55cf0debcb09bd365
SHA1 21fe6387723555bc6dfa5520126e0212de83adee
SHA512 e0da524cbcb82976d620bc4e12f48a4448537459e8dc13feecffdfd7bb2a1ed99c4c1001f84ae1d7ab29756385570005d3540d36747a73e9dd13724bab7c24e0
SSDEEP 6144:jEG9l5eKcAEcgYEGDl5eKcAEcXgulUNt2Lja1M+9klvLc2:jGgEgAgEAXd3wM452
TLSH
T187A4592233F59A25F4F31B354CB5C051AA37BF919A71D91D2288B15E0A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c527-3.dat	family_stormser
behavioral2/files/0x000e00000001c528-6.dat	family_stormser
behavioral2/files/0x000f00000001c527-12.dat	family_stormser

Auto-generated rule 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c527-3.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e00000001c528-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000f00000001c527-12.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Detects Windows executables referencing Office macro registry keys. Observed modifying Office config 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c527-3.dat	INDICATOR_SUSPICIOUS_EXE_Enable_OfficeMacro
behavioral2/files/0x000e00000001c528-6.dat	INDICATOR_SUSPICIOUS_EXE_Enable_OfficeMacro
behavioral2/files/0x000f00000001c527-12.dat	INDICATOR_SUSPICIOUS_EXE_Enable_OfficeMacro

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}	2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}\stubpath = "C:\\Windows\\{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe"	2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5517118C-49AB-4db1-A7CC-C364143F31DD}	{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5517118C-49AB-4db1-A7CC-C364143F31DD}\stubpath = "C:\\Windows\\{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe"	{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}	{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}\stubpath = "C:\\Windows\\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe"	{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe

Executes dropped EXE 4 IoCs

pid	Process
1988	{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe
5976	{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe
800	{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe
4364	{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe	{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe
File created	C:\Windows\{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe	2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe
File created	C:\Windows\{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe	{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{D9741BE8-BEE0-4F2A-8F85-13294CB3D5F9}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5688	2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe
Token: SeIncBasePriorityPrivilege	1988	{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe
Token: SeIncBasePriorityPrivilege	5976	{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe
Token: SeShutdownPrivilege	2032	explorer.exe
Token: SeCreatePagefilePrivilege	2032	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4684	sihost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5688 wrote to memory of 1988	5688	2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe	87
PID 5688 wrote to memory of 960	5688	2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe	88
PID 1988 wrote to memory of 5976	1988	{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe	89
PID 1988 wrote to memory of 2084	1988	{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe	90
PID 5976 wrote to memory of 800	5976	{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe	91
PID 5976 wrote to memory of 4352	5976	{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe	92
PID 4684 wrote to memory of 2032	4684	sihost.exe	97
PID 2032 wrote to memory of 4364	2032	explorer.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_4fc556c50bee7fb55cf0debcb09bd365_elex_goldeneye_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5688
- C:\Windows\{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe
  C:\Windows\{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1988
- - C:\Windows\{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe
    C:\Windows\{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5976
  - - C:\Windows\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe
      C:\Windows\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{55171~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4352
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{76BAF~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:960

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe
    "C:\Windows\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe

Path C:\Windows\{51E17B1A-E464-4348-8489-BC3E9A3BF1B5}.exe
Size 468KB
SHA256 5df3aa3aa85de6c8195dcda1b88e0fc3881160a4ec81238223df8394b79a036a
MD5 c5270bcfea49f7f7761d8fdfc497cf1e
SHA1 55c06aab4eebfcb113f4d24e471d4845d2ecbb22
SHA512 b27e15c06fe11e16d9a0ab4b3f4e4adf720eeec5df1052096e91399f6834a43c7d3242acec247d7ea462d471005e0f426e9fa793886cf3d98fa42f6c0c5b648a
SSDEEP 6144:jEGyl5eKcAEcgYEGDl5eKcAEcXgulUNt2Lja1M+9klvLc2:j5gEgAgEAXd3wM452
TLSH
T1DEA4592233F59A25F4F31B354CB5C051AA37BF919A71D91D2288B15E0A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe

Path C:\Windows\{5517118C-49AB-4db1-A7CC-C364143F31DD}.exe
Size 468KB
SHA256 04f049bcfd135355c6fcb11832ab5e385a01ad871e7af371d2e6aae432479343
MD5 7739b860a8873a42ec1939f2564644a2
SHA1 29e74ba882238772df9a86b0c8d44fd8534f99d8
SHA512 6adca50c4e0ef0fe8c186b77fa9b9efccbdbbc22a62bb3ab36e3a669c1ee13d29fbc3ddbf3c1bb7e117344e8ee87fd8fbd0f0510dd4a5e85d2216998093c8754
SSDEEP 6144:jEGSl5eKcAEcgYEGDl5eKcAEcXgulUNt2Lja1M+9klvLc2:jBgEgAgEAXd3wM452
TLSH
T151A4592233F59A25F4F31B354CB5C051AA37BF919A71D91D2288B15E0A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe

Path C:\Windows\{76BAF1A4-F1F0-4b6d-938B-7A33884A6189}.exe
Size 468KB
SHA256 f2c7920bd7c74514f9134415156a65b4498c10d4ffc5e13ace8c9e99f015acb2
MD5 604045d27b5c325462c4142bdd596045
SHA1 533c719dbc0b1239ad63a7728d9d98943b894e69
SHA512 3574ffda34a51b727d184fa420a772063b6385859db9003cbcdc19d0329fd2d01ffe25b0120e96c7a832c1aa59d8057c833b8c4ce4a84dc12fb79820ed375a24
SSDEEP 6144:jEG8l5eKcAEcgYEGDl5eKcAEcXgulUNt2Lja1M+9klvLc2:jzgEgAgEAXd3wM452
TLSH
T163A4592233F59A25F4F31B354CB5C051AA37BF919A71D91D2288B15E0A72B80CE75B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads