stormser | 8dff9f405661c87cb41d9309540d677f5768230548303fa4cf8dfc72a76fad67

General

Target
2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe
Size 59KB
Sample260704-ex46dsfs3p
SHA256 8dff9f405661c87cb41d9309540d677f5768230548303fa4cf8dfc72a76fad67
MD5 77058356ce217abf85a71b74c4121f7c
SHA1 b8c99f9def6664f20f04f3adfeb53a12ddf316a2
SHA512 d91293350ee84cbc03d50cc8f8fb30e8a03b8d42f930fd9b13331bc88c19fd100d38b9a0d683c1b611727883d6440e447ab3a1a64997856a1fb4d6add4ba3791
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrojXP3i4/CFsrcGIiXY1nhbHQn:Mvw9816vhKQLrojXfi4/wQDIi4dHQ
TLSH
T1FE436D830FE948F2F7911171057D5BB9527BAAC0D209BEDB7F80DE28117B242E53E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral2/files/0x001300000001c42b-3.dat	family_stormser
behavioral2/files/0x000e00000001c42d-6.dat	family_stormser
behavioral2/files/0x001100000001c431-13.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6C86C45-4521-41ee-848C-A9FC6AE2322B}\stubpath = "C:\\Windows\\{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe"	{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}	{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}\stubpath = "C:\\Windows\\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe"	{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC136A1B-C085-4d98-9130-BEB86BE50F44}	2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FC136A1B-C085-4d98-9130-BEB86BE50F44}\stubpath = "C:\\Windows\\{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe"	2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A6C86C45-4521-41ee-848C-A9FC6AE2322B}	{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe

Executes dropped EXE 4 IoCs

pid	Process
2644	{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe
5560	{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe
5812	{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe
3448	{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe	2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe
File created	C:\Windows\{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe	{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe
File created	C:\Windows\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe	{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{3D489B64-50E4-4C23-B20F-C7104E53D0C9}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5352	2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2644	{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe
Token: SeIncBasePriorityPrivilege	5560	{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeCreatePagefilePrivilege	892	explorer.exe
Token: SeShutdownPrivilege	892	explorer.exe
Token: SeCreatePagefilePrivilege	892	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5880	sihost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5352 wrote to memory of 2644	5352	2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe	88
PID 5352 wrote to memory of 1216	5352	2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe	89
PID 2644 wrote to memory of 5560	2644	{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe	90
PID 2644 wrote to memory of 5516	2644	{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe	91
PID 5560 wrote to memory of 5812	5560	{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe	97
PID 5560 wrote to memory of 2020	5560	{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe	98
PID 5880 wrote to memory of 892	5880	sihost.exe	99
PID 892 wrote to memory of 3448	892	explorer.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_77058356ce217abf85a71b74c4121f7c_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Windows\{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe
  C:\Windows\{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe
    C:\Windows\{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\Windows\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe
      C:\Windows\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5812
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A6C86~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{FC136~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1216

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe
    "C:\Windows\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe

Path C:\Windows\{42AFD66A-CF16-416e-9FFE-CBCDB2BDE626}.exe
Size 59KB
SHA256 40503bcb60eafe65bc7aae2da99f4decabf4fe6cce983eac0e1a3c478971f1ca
MD5 c3c9f22189680daff972ba91fcc91db9
SHA1 85073bf11eff6e85bedf24718a32560319141d00
SHA512 24624d3cfe56ba2cfbd3e92ee7d425e313480bd97faf8ec76defd66a03d8f92f33ba6e2fae97bd1479d8d93677ff818aad539421ccc8cff33452d5a6f6be5b53
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrojXP3V4/CFsrcGIiXY1nhbHQn:Mvw9816vhKQLrojXfV4/wQDIi4dHQ
TLSH
T139436D830FE948F2F7911171017D5BB9527BAAC0D209BEDB7F80DE28517B242E53E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe

Path C:\Windows\{A6C86C45-4521-41ee-848C-A9FC6AE2322B}.exe
Size 59KB
SHA256 f81b160fbbc63428e7bd5a030ae5585136fa766adbc80786f41049b9238feaf0
MD5 9bba1bbad9c0cedfbed97b5ca0e58383
SHA1 917b06f591f17d9989847fbfeee6ff37c2929eae
SHA512 629e9c2a25989b63cadc6bd7da47221f21885ed2c1afa7e68a05a477ade3e44a5dc64ddb9a12288623878b3f4f6b27f7f76b89028c195dcc9a4f619e580b0ccc
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrojXP3G4/CFsrcGIiXY1nhbHQn:Mvw9816vhKQLrojXfG4/wQDIi4dHQ
TLSH
T14C436D830FE948F2F7911171057D5BB9527BAAC0D209BEDB7F80DE28517B242E63E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe

Path C:\Windows\{FC136A1B-C085-4d98-9130-BEB86BE50F44}.exe
Size 59KB
SHA256 b8543c660179a03fe846c0d5b234d6a6632c92c178996e82434a988ff8e81191
MD5 a305e8a753f5072b7541054bf1e759ac
SHA1 b52c5dc13b678ebe1985240922ed1663d455e11e
SHA512 f9ad7a2d20c7401e9ccd5edb79e42190f89527de0c307b1edc36af3a1e8c41d76c3eb5b437deab02c916494970af67e433f4e76722d6a7a20c036556a0dfbd3b
SSDEEP 384:MbLwOs8AHsc4sMfwhKQLrojXP304/CFsrcGIiXY1nhbHQn:Mvw9816vhKQLrojXf04/wQDIi4dHQ
TLSH
T189436D830FE948F2F7911171057D5BB9627BAAC0D209BEDB7F80DE28117B252E53E14A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads