stormser | 02eb5ed23b068e959923635de50087783220907afd129c2a5f4575d0925f58b3

General

Target
2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe
Size 320KB
Sample260705-d93yeshs6t
SHA256 02eb5ed23b068e959923635de50087783220907afd129c2a5f4575d0925f58b3
MD5 79ec1707a666078ee8cf648fdc735229
SHA1 4364e3f4f6056da6fca32dcd22141e3673372b36
SHA512 daec05e807f115fdd0d46f516c0a8074348a19c2e9b6afed3e0f98704f2d5f55829cd36635a08b0f10775d4b8f7e70616920e51881b69ce35957817d2124ace8
SSDEEP 3072:fDEGh0oUlZdOe2MUVg3bHrH/HqOYGb+4QnZSe+rcC4F0fJGRIS8Rfd7eQEjMUy:bEGKlnOe2MUVg3vdeKcAEjy
TLSH
T1E864A63D5FE6D5E5E0B38A704DB5C501A9BBBA5139318F1F00DA021E4C21AE1DDA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c507-3.dat	family_stormser
behavioral2/files/0x000e00000001c508-6.dat	family_stormser
behavioral2/files/0x000e00000001c50a-13.dat	family_stormser
behavioral2/files/0x001100000001c50c-19.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E850A187-CC83-4716-9B73-6EC1FCD2F545}\stubpath = "C:\\Windows\\{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe"	{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}	{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}\stubpath = "C:\\Windows\\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe"	{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DD28C21-61B4-498e-A22C-620421B17479}	2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1DD28C21-61B4-498e-A22C-620421B17479}\stubpath = "C:\\Windows\\{1DD28C21-61B4-498e-A22C-620421B17479}.exe"	2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}	{1DD28C21-61B4-498e-A22C-620421B17479}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}\stubpath = "C:\\Windows\\{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe"	{1DD28C21-61B4-498e-A22C-620421B17479}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E850A187-CC83-4716-9B73-6EC1FCD2F545}	{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe

Executes dropped EXE 5 IoCs

pid	Process
4604	{1DD28C21-61B4-498e-A22C-620421B17479}.exe
5696	{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe
4072	{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe
5716	{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe
4820	{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{1DD28C21-61B4-498e-A22C-620421B17479}.exe	2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe
File created	C:\Windows\{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe	{1DD28C21-61B4-498e-A22C-620421B17479}.exe
File created	C:\Windows\{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe	{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe
File created	C:\Windows\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe	{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1DD28C21-61B4-498e-A22C-620421B17479}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557124681-2609731375-3674401788-1000\{AD5E1B5F-6E1E-459F-992F-2C1233C79120}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5728	2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4604	{1DD28C21-61B4-498e-A22C-620421B17479}.exe
Token: SeIncBasePriorityPrivilege	5696	{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe
Token: SeIncBasePriorityPrivilege	4072	{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe
Token: SeShutdownPrivilege	1128	explorer.exe
Token: SeCreatePagefilePrivilege	1128	explorer.exe
Token: SeShutdownPrivilege	1128	explorer.exe
Token: SeCreatePagefilePrivilege	1128	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3392	sihost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5728 wrote to memory of 4604	5728	2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe	88
PID 5728 wrote to memory of 2680	5728	2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe	89
PID 4604 wrote to memory of 5696	4604	{1DD28C21-61B4-498e-A22C-620421B17479}.exe	90
PID 4604 wrote to memory of 4968	4604	{1DD28C21-61B4-498e-A22C-620421B17479}.exe	91
PID 5696 wrote to memory of 4072	5696	{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe	93
PID 5696 wrote to memory of 5304	5696	{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe	94
PID 4072 wrote to memory of 5716	4072	{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe	99
PID 4072 wrote to memory of 3480	4072	{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe	100
PID 3392 wrote to memory of 1128	3392	sihost.exe	101
PID 1128 wrote to memory of 4820	1128	explorer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_79ec1707a666078ee8cf648fdc735229_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\{1DD28C21-61B4-498e-A22C-620421B17479}.exe
  C:\Windows\{1DD28C21-61B4-498e-A22C-620421B17479}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe
    C:\Windows\{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Windows\{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe
      C:\Windows\{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Windows\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe
        
        C:\Windows\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5716
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E850A~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F1A3B~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:5304
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1DD28~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2680

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe
    "C:\Windows\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1DD28C21-61B4-498e-A22C-620421B17479}.exe

Path C:\Windows\{1DD28C21-61B4-498e-A22C-620421B17479}.exe
Size 320KB
SHA256 b90348d472b8db5f8725f3034449245d9ee937099b7161b8cd5d93af82105224
MD5 1b5925083a3a7d5e269b131d6c04f500
SHA1 d525fa33424f00b29d4cfd3f65ab010980ac2892
SHA512 23d4229c27b4869042c9f51b4a6ca82d127494bd91e67e3ff5c0f04ee918c0bf3fa126b941e9d9b7b79becf3733f3f3324f2271a1074ebdc1b3e768adf651675
SSDEEP 3072:fDEGh0oVlZdOe2MUVg3bHrH/HqOYGb+4QnZSe+rcC4F0fJGRIS8Rfd7eQEjMUy:bEGzlnOe2MUVg3vdeKcAEjy
TLSH
T17364A63D5FE6D5E5E0B38A704DB5C501A9BBBA5139318F1F00DA021E4C21AE1DDA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe

Path C:\Windows\{39AF3DDA-BA0F-4793-BF87-E53E5CCFFAC4}.exe
Size 320KB
SHA256 3053ffb3cd94867c186386485040a6f8f080d650fdb5c845ccb6d333638cfb41
MD5 7dccdd5952258741471a79d050e71db4
SHA1 a371ede148dc98861c01f5fd93c7439d496d1518
SHA512 2c7e773591b3e9d474a9702f11db5b4ba0cc6a4a9b3f377f520902796ee166589719c72acd70288ad119def074a3906e8a53a54f0d591c72b91b38972d1768d9
SSDEEP 3072:fDEGh0o9lZdOe2MUVg3bHrH/HqOYGb+4QnZSe+rcC4F0fJGRIS8Rfd7eQEjMUy:bEGrlnOe2MUVg3vdeKcAEjy
TLSH
T18064A63D5FE6D5E5E0B38A704DB5C501A9BBBA5139318F1F00DA021E4C21AE1DDA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe

Path C:\Windows\{E850A187-CC83-4716-9B73-6EC1FCD2F545}.exe
Size 320KB
SHA256 26974baae53b3544ce9a15ef1df8572163f1526253f0d96d97592713312ab60a
MD5 843e4e631e29795be0f46b72b73c5321
SHA1 113e22ff6abfad7329ae93ed948b64a28653db1f
SHA512 640fedd59e8770e95fe30bc35299e1e63ebf92fb3fb47500c92e06ebfaee3fa682620b7d52b0fb2419f6edb9804ef31ba4555a85a61148d035eaef64236b047b
SSDEEP 3072:fDEGh0otlZdOe2MUVg3bHrH/HqOYGb+4QnZSe+rcC4F0fJGRIS8Rfd7eQEjMUy:bEGXlnOe2MUVg3vdeKcAEjy
TLSH
T12764A63D5FE6D5E5E0B38A704DB5C501A9BBBA5139318F1F00DA021E4C21AE1DDA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe

Path C:\Windows\{F1A3BAC7-72B3-47c5-944A-5BE3AD992CFC}.exe
Size 320KB
SHA256 6322056a181d8eaa3a6db59861874d1ad8400bb6ed8d2f069775e53d7ef6ef76
MD5 301345af5070218b1c3c9bdaf080a2cc
SHA1 21d0d1c755a590de255ffa8bc7a2a0769bbfe8e1
SHA512 53aab84fd09cc8963859177b8c699d1daf8267151d64736d55bedb24d032c7d7787704f208249d1facc155ecbf8bf6664233c1aad125036ac543ee8b5453edee
SSDEEP 3072:fDEGh0oTlZdOe2MUVg3bHrH/HqOYGb+4QnZSe+rcC4F0fJGRIS8Rfd7eQEjMUy:bEGdlnOe2MUVg3vdeKcAEjy
TLSH
T14D64A63D5FE6D5E5E0B38A704DB5C501A9BBBA5139318F1F00DA021E4C21AE1DDA6B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads