stormser | ad0d5751bfc0530448bd1216f99028a36180f741ce42e3d5f3d1bf454f0cc778

General

Target
2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe
Size 59KB
Sample260703-dalvvsft8l
SHA256 ad0d5751bfc0530448bd1216f99028a36180f741ce42e3d5f3d1bf454f0cc778
MD5 8e31b6804f8a36cc871f7c1b1279eeea
SHA1 76696a6bd2a82041e6a59a831320f3e2c936e987
SHA512 8a93f525d1ea9fdee87abeaa78829bac3567599d9a5b30595fba35aba9ebe73970be69c19da1d5bb1a699f90ef4d075f4886da83ad6d731c1d17b9eebaab8776
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwkY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroS4/CFsrd
TLSH
T1A24309834BDE5CF2F791123108794AB9927B9AC4910EBE9FBF90CD540037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x000800000002441c-2.dat	family_stormser
behavioral1/files/0x000700000002442d-6.dat	family_stormser
behavioral1/files/0x0007000000024438-10.dat	family_stormser
behavioral1/files/0x0007000000024439-14.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF136A81-F638-418a-8B71-5A12927B85AC}	{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FF136A81-F638-418a-8B71-5A12927B85AC}\stubpath = "C:\\Windows\\{FF136A81-F638-418a-8B71-5A12927B85AC}.exe"	{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1203A070-14C3-411e-AE4C-C19A192A9DD4}	{FF136A81-F638-418a-8B71-5A12927B85AC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1203A070-14C3-411e-AE4C-C19A192A9DD4}\stubpath = "C:\\Windows\\{1203A070-14C3-411e-AE4C-C19A192A9DD4}.exe"	{FF136A81-F638-418a-8B71-5A12927B85AC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD7F1EBC-A717-406a-9D37-927CB7F536BA}	2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD7F1EBC-A717-406a-9D37-927CB7F536BA}\stubpath = "C:\\Windows\\{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe"	2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}	{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}\stubpath = "C:\\Windows\\{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe"	{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe

Executes dropped EXE 4 IoCs

pid	Process
4580	{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe
516	{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
2648	{FF136A81-F638-418a-8B71-5A12927B85AC}.exe
2332	{1203A070-14C3-411e-AE4C-C19A192A9DD4}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe	2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe
File created	C:\Windows\{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe	{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe
File created	C:\Windows\{FF136A81-F638-418a-8B71-5A12927B85AC}.exe	{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
File created	C:\Windows\{1203A070-14C3-411e-AE4C-C19A192A9DD4}.exe	{FF136A81-F638-418a-8B71-5A12927B85AC}.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FF136A81-F638-418a-8B71-5A12927B85AC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1203A070-14C3-411e-AE4C-C19A192A9DD4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4696	2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4580	{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe
Token: SeIncBasePriorityPrivilege	516	{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
Token: SeIncBasePriorityPrivilege	2648	{FF136A81-F638-418a-8B71-5A12927B85AC}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4580	4696	2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe	85
PID 4696 wrote to memory of 2088	4696	2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe	86
PID 4580 wrote to memory of 516	4580	{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe	95
PID 4580 wrote to memory of 4728	4580	{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe	96
PID 516 wrote to memory of 2648	516	{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe	99
PID 516 wrote to memory of 3020	516	{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe	100
PID 2648 wrote to memory of 2332	2648	{FF136A81-F638-418a-8B71-5A12927B85AC}.exe	101
PID 2648 wrote to memory of 4032	2648	{FF136A81-F638-418a-8B71-5A12927B85AC}.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_8e31b6804f8a36cc871f7c1b1279eeea_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe
  C:\Windows\{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
    C:\Windows\{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\Windows\{FF136A81-F638-418a-8B71-5A12927B85AC}.exe
      C:\Windows\{FF136A81-F638-418a-8B71-5A12927B85AC}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Windows\{1203A070-14C3-411e-AE4C-C19A192A9DD4}.exe
        
        C:\Windows\{1203A070-14C3-411e-AE4C-C19A192A9DD4}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2332
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{FF136~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4032
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{09A35~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{BD7F1~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe

Path C:\Windows\{09A35720-A8EB-4cb3-B1E8-7BA4B40C55AC}.exe
Size 59KB
SHA256 8149282f7a00d961b95e619f9f0e6d26f50590d68ceff6d7b30b52904adcd01a
MD5 000355efe2c8415a756a4915467ac1b1
SHA1 f0356daba7bcc752dea86d98d6b31dd48b51b651
SHA512 6d5271bae8b000780539d355420827167cd15afedc1b8d3355ade16d0c5784eaebcd46228acb4a60bfa945224a7be31945e55a5485ec824fdbc8cf9e426c791e
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwQhY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroQT4/CFsrd
TLSH
T15F4309834BDE5CF2F791127108794AB9927B9AC4910EBE9FBF90CE540037292E53A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{1203A070-14C3-411e-AE4C-C19A192A9DD4}.exe

Path C:\Windows\{1203A070-14C3-411e-AE4C-C19A192A9DD4}.exe
Size 59KB
SHA256 fbfe9f899248cfabf2e01e2e58ad4fac2dad34d0c92bc30618c9c14e8f61bf3e
MD5 400519ba2ef001eaad271094ca090ea2
SHA1 5f10362ecf670b9f48a9e3e850b4db7665f9e2cf
SHA512 782e34804aa2de0391c88c6d509bfb20694b81e76c95128f588a45026557f721437bbf5423a875ceec4b97b798efb86e8bfca8a39ae25f6d9051b68f9688139e
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwXY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLrop4/CFsrd
TLSH
T1824309834BDE5CF2F791123108794AB9927B99D4910EBE9FBF90CD540037692E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe

Path C:\Windows\{BD7F1EBC-A717-406a-9D37-927CB7F536BA}.exe
Size 59KB
SHA256 32dedf8672663bd70f36554f256eba0806de17f174006677a34e6630f9d88bdf
MD5 f5973c28e4b5ff7174e6daa37aa0b425
SHA1 8b5638fbd113adaba7fcf41c595cc7651318ec5e
SHA512 bbcaa0ecfeb45de637e38d1eb9a8a67a9eb7c5ce6c178ca05806e371964f3266286ba0bac8d203559c29ba09273026a9b110521106d58a182d41b8ae4d3ce267
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwzY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLroV4/CFsrd
TLSH
T1D84309834BDE9CF2F791123108794AB9927B9AD4910EBE9FBF90CD550037292E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FF136A81-F638-418a-8B71-5A12927B85AC}.exe

Path C:\Windows\{FF136A81-F638-418a-8B71-5A12927B85AC}.exe
Size 59KB
SHA256 25f183acbe35b92f04af6898a8cfc8afe3f7fceddbba6254463726089e62107c
MD5 0c2093feaf3b4b438b2dba0af1d7f139
SHA1 4b2ea0b297e10348c8832b22fa12f2550f6a2980
SHA512 70f084c5c675d657802088e92bac8f600cb695daf2744342c2f3573d27d9a9ce749897dfb92e0fca94977c98884cdc526b2af0ca978104f7b732ddc1c88bee8e
SSDEEP 192:kbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwXY04/CFxyNhoy5t:kbLwOs8AHsc4sMfwhKQLrop4/CFsrd
TLSH
T1924309834BDE5CF2F791123108794AB9927B9AC4910EBE9FBF90CD540037292E53A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads