stormser | cd27b5a0a84820bfb215b2bbb7875d099703413bc82ac2ec8a58010e24852b2f

General

Target
2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe
Size 60KB
Sample260704-e2scdsa16y
SHA256 cd27b5a0a84820bfb215b2bbb7875d099703413bc82ac2ec8a58010e24852b2f
MD5 0f6f6e446cb749727a212aaf795752c2
SHA1 131cd8cf3219e8bddcfc1e7a727f39157e614307
SHA512 0a8ecf7a5cb0b001da7f6d228993548bfefa098557327dcc632f462759595f9dd6f18d9cc454878c1a25c551136655661869d21137c91a6bcf203a6ec56c7dcf
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwGOY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroP4/CFsrd
TLSH
T1045309834BDE9CF2F791113108795AB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c561-3.dat	family_stormser
behavioral2/files/0x000e00000001c562-6.dat	family_stormser
behavioral2/files/0x000f00000001c561-13.dat	family_stormser
behavioral2/files/0x000f00000001c562-18.dat	family_stormser
behavioral2/files/0x000d00000001c569-23.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6307C54-8EF3-4ade-A09C-E866492DDC0F}\stubpath = "C:\\Windows\\{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe"	2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62B11701-45EA-475f-BD56-1B160568C5C3}\stubpath = "C:\\Windows\\{62B11701-45EA-475f-BD56-1B160568C5C3}.exe"	{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31053563-5153-40e0-B0E8-022B7793942E}\stubpath = "C:\\Windows\\{31053563-5153-40e0-B0E8-022B7793942E}.exe"	{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84A5F803-D387-402a-B34A-7CDF401E3049}	{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{84A5F803-D387-402a-B34A-7CDF401E3049}\stubpath = "C:\\Windows\\{84A5F803-D387-402a-B34A-7CDF401E3049}.exe"	{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{62B11701-45EA-475f-BD56-1B160568C5C3}	{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{31053563-5153-40e0-B0E8-022B7793942E}	{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{359075C7-E990-42eb-B3C3-2F2F3F37256E}	{31053563-5153-40e0-B0E8-022B7793942E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{359075C7-E990-42eb-B3C3-2F2F3F37256E}\stubpath = "C:\\Windows\\{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe"	{31053563-5153-40e0-B0E8-022B7793942E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B6307C54-8EF3-4ade-A09C-E866492DDC0F}	2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe

Executes dropped EXE 6 IoCs

pid	Process
5740	{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
3996	{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
1420	{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
4348	{31053563-5153-40e0-B0E8-022B7793942E}.exe
4912	{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe
252	{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{84A5F803-D387-402a-B34A-7CDF401E3049}.exe	{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
File created	C:\Windows\{62B11701-45EA-475f-BD56-1B160568C5C3}.exe	{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
File created	C:\Windows\{31053563-5153-40e0-B0E8-022B7793942E}.exe	{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
File created	C:\Windows\{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe	{31053563-5153-40e0-B0E8-022B7793942E}.exe
File created	C:\Windows\{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe	2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{31053563-5153-40e0-B0E8-022B7793942E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{E259FCC0-54C3-43AD-ABA0-D6E48FC54E67}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2568	2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	5740	{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
Token: SeIncBasePriorityPrivilege	3996	{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
Token: SeIncBasePriorityPrivilege	1420	{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
Token: SeIncBasePriorityPrivilege	4348	{31053563-5153-40e0-B0E8-022B7793942E}.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe
Token: SeShutdownPrivilege	4352	explorer.exe
Token: SeCreatePagefilePrivilege	4352	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6008	sihost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 5740	2568	2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe	88
PID 2568 wrote to memory of 4544	2568	2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe	89
PID 5740 wrote to memory of 3996	5740	{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe	90
PID 5740 wrote to memory of 6028	5740	{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe	91
PID 3996 wrote to memory of 1420	3996	{84A5F803-D387-402a-B34A-7CDF401E3049}.exe	92
PID 3996 wrote to memory of 5516	3996	{84A5F803-D387-402a-B34A-7CDF401E3049}.exe	93
PID 1420 wrote to memory of 4348	1420	{62B11701-45EA-475f-BD56-1B160568C5C3}.exe	94
PID 1420 wrote to memory of 5856	1420	{62B11701-45EA-475f-BD56-1B160568C5C3}.exe	95
PID 4348 wrote to memory of 4912	4348	{31053563-5153-40e0-B0E8-022B7793942E}.exe	99
PID 4348 wrote to memory of 4100	4348	{31053563-5153-40e0-B0E8-022B7793942E}.exe	100
PID 6008 wrote to memory of 4352	6008	sihost.exe	102
PID 4352 wrote to memory of 252	4352	explorer.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_0f6f6e446cb749727a212aaf795752c2_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
  C:\Windows\{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
    C:\Windows\{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
      C:\Windows\{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Windows\{31053563-5153-40e0-B0E8-022B7793942E}.exe
        
        C:\Windows\{31053563-5153-40e0-B0E8-022B7793942E}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4348
      - C:\Windows\{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe
        
        C:\Windows\{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4912
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{31053~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4100
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{62B11~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{84A5F~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:5516
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{B6307~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4544

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6008
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe
    "C:\Windows\{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{31053563-5153-40e0-B0E8-022B7793942E}.exe

Path C:\Windows\{31053563-5153-40e0-B0E8-022B7793942E}.exe
Size 60KB
SHA256 d1cf838c553343185e5b78c434c4d17015112630a3034fb510f48bff8820504b
MD5 6e7e493f0b63eeae9e81dc36edb8ab55
SHA1 0af699d205d3962448f8343084a236ac97da1385
SHA512 c9aa1c9d4d2f795a3f272ed58c3ff9fe7942a49822f3a6e2af4f66e108a2ddaaf2cec2c8535d4e8f494388d1faf3aa9f95b1ddb3f698f553264d2b28b32d0abd
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwKY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrog4/CFsrd
TLSH
T1E35308834BEE5CF2F791117108798AB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe

Path C:\Windows\{359075C7-E990-42eb-B3C3-2F2F3F37256E}.exe
Size 60KB
SHA256 696fa0e65a70d6fe71e03f3e8c1c70066b3f3d266e78db9bc2086fcac768b62e
MD5 bb72ddbea6bdc3d9ba565a1bca34a13a
SHA1 85f62a6080fd4fc1d39147cc6267754d5470b65e
SHA512 29d91d9536d2d5b70d579b2edbb15e40edf176afdea89147edab0760404c5b6e0af783654409743b8bd4d28610d60478abcbd170731ee55b45ac408a83dbcef1
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwNY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrof4/CFsrd
TLSH
T1265309834BEE5CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{62B11701-45EA-475f-BD56-1B160568C5C3}.exe

Path C:\Windows\{62B11701-45EA-475f-BD56-1B160568C5C3}.exe
Size 60KB
SHA256 486b5c5b9595975477919be21b032186f5abf2414cbe10ecd5a680a75efea376
MD5 e3298e150d9af00a6695b9ed70a6e9c7
SHA1 65968e639ed39a684c06fb7bed65111cca450fe1
SHA512 7c0836cfc46ea652932c4e480e4240ecbb2ec6c3b2e0c859d40398596e1ef1f612772a9205962840b75b1dcab339247607adc3ffb53c737b4db8a203c6d3bd9f
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwhY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroT4/CFsrd
TLSH
T14D5308834BDE5CF2F6911231087D8AB9927B99D4910EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{84A5F803-D387-402a-B34A-7CDF401E3049}.exe

Path C:\Windows\{84A5F803-D387-402a-B34A-7CDF401E3049}.exe
Size 60KB
SHA256 a0b5083d54fc27cc431db3c333149db751a071be216ba51365cc073fba10edab
MD5 e2d988e2bcd7ae0fc7c783329ecc895f
SHA1 a8acc30321356baa40a0999f9102c8397820ae60
SHA512 936597170295a0af57ee9711784dcde6652268e93a61af06a26a9ec1be6a5795e64df1bfb2b39c0f523c757bcc08ebfde23b45cea1cb8bd33744546b09633f0e
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw05Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro0L4/CFsrd
TLSH
T1EC53F8834BEE5CF2F6911171087D8AB9927B99C4950EBEEFBB90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe

Path C:\Windows\{B6307C54-8EF3-4ade-A09C-E866492DDC0F}.exe
Size 60KB
SHA256 d0419234ee93f92576482734f05ae9ed6382daa021fee3fbb83fe48d2cf4092b
MD5 ecb244824e1e8525830f25e84dd9ffd0
SHA1 ff1bac940b7040d9cee11f2908e64e9681f3ce82
SHA512 4a33f9db54a4365cab9d5816b99f55ad4fa2f8ea785debd78256a7085eb562637045d86776db57aec319e058cfb4fbb3cf5ea15447d2733fe17b7c40e7db02f3
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwBqY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroBA4/CFsrd
TLSH
T1845309834BDE9CF2F791123108798AB9927B99C4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads