stormser | a7d0224f2a528b1a7b9a38a7e05d0243e1892cbc6d284cb534ed4d90c7b13720

General

Target
2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe
Size 79KB
Sample260705-gslvcsdz2m
SHA256 a7d0224f2a528b1a7b9a38a7e05d0243e1892cbc6d284cb534ed4d90c7b13720
MD5 c4bb7de9f0284959cfa2612eff3f7e41
SHA1 c28e9dcb3a40b035a0f9d7008c167538ed64ba92
SHA512 0a83758021422976d87118703cb8b87e66db1f2248675409c1c7a42213f0e955ded21d0c0541fad1e02f2c613469183f1884edc599d6e9cbba569c06456ce4f6
SSDEEP 768:4vw9816vhKQLroJL4/wQzXOQ69zbjlAAX5e9zz:wEGh0oJLlGizbR9Xwzz
TLSH
T100835CD38EAC4483FDD6697012B8D9A77C3E97C6150479AB6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c514-3.dat	family_stormser
behavioral2/files/0x000e00000001c515-6.dat	family_stormser
behavioral2/files/0x000f00000001c514-13.dat	family_stormser
behavioral2/files/0x000f00000001c515-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39B073B6-0258-4d8b-A5E3-23101DB8ED02}	{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{39B073B6-0258-4d8b-A5E3-23101DB8ED02}\stubpath = "C:\\Windows\\{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe"	{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}	{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}\stubpath = "C:\\Windows\\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe"	{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F7008C4-B87B-4018-B378-59D0298D6A73}	2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6F7008C4-B87B-4018-B378-59D0298D6A73}\stubpath = "C:\\Windows\\{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe"	2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F317C3D9-3316-4618-A460-FA1CE73864BB}	{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F317C3D9-3316-4618-A460-FA1CE73864BB}\stubpath = "C:\\Windows\\{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe"	{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe

Executes dropped EXE 5 IoCs

pid	Process
3076	{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe
1104	{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
4692	{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe
6100	{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe
5528	{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe	2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe
File created	C:\Windows\{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe	{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe
File created	C:\Windows\{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe	{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
File created	C:\Windows\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe	{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{D1B466EE-005B-4A74-9A01-AE5FFA4480EC}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	6076	2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3076	{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe
Token: SeIncBasePriorityPrivilege	1104	{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
Token: SeIncBasePriorityPrivilege	4692	{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe
Token: SeShutdownPrivilege	5708	explorer.exe
Token: SeCreatePagefilePrivilege	5708	explorer.exe
Token: SeShutdownPrivilege	5708	explorer.exe
Token: SeCreatePagefilePrivilege	5708	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1544	sihost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 3076	6076	2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe	88
PID 6076 wrote to memory of 2688	6076	2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe	89
PID 3076 wrote to memory of 1104	3076	{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe	90
PID 3076 wrote to memory of 4916	3076	{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe	91
PID 1104 wrote to memory of 4692	1104	{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe	92
PID 1104 wrote to memory of 4132	1104	{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe	93
PID 4692 wrote to memory of 6100	4692	{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe	94
PID 4692 wrote to memory of 4720	4692	{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe	95
PID 1544 wrote to memory of 5708	1544	sihost.exe	100
PID 5708 wrote to memory of 5528	5708	explorer.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_c4bb7de9f0284959cfa2612eff3f7e41_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Windows\{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe
  C:\Windows\{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
    C:\Windows\{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe
      C:\Windows\{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4692
    - - C:\Windows\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe
        
        C:\Windows\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6100
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{39B07~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4720
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F317C~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{6F700~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2688

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe
    "C:\Windows\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe

Path C:\Windows\{39B073B6-0258-4d8b-A5E3-23101DB8ED02}.exe
Size 79KB
SHA256 cb7a228bbb1da8943187603957da84b27f3cc0c2fadc8c3b8d5464b29563e06d
MD5 392e8cb9e27df87eeb44cb0f9220fda9
SHA1 559c5cb3a37b8740aa01d161b7dcd24f156f20bb
SHA512 49da1820377bdac263b0c7d2e6f227cde7a6cac63745eebfb87966d8a2b328c6585e37500c285014ebe730eda3e5c71bc9009d56dffd5622945c8990f63d0ccd
SSDEEP 768:4vw9816vhKQLroX4/wQzXOQ69zbjlAAX5e9zz:wEGh0oXlGizbR9Xwzz
TLSH
T140835CD38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe

Path C:\Windows\{6F7008C4-B87B-4018-B378-59D0298D6A73}.exe
Size 79KB
SHA256 8823f7441fd342ac5f07905016d689edcb49104dbaeb8857d529a0422aeb0feb
MD5 d62cf2aa340fb1e5d07ccd48f4d371a9
SHA1 aef09c9db5286b4681e7247fb5f7dce40da856d6
SHA512 50bd87d05d78c310e930cefeeafe62fb717b416dc908ca6f713d67ca9c8a225ddd9dddccc1b8f5cc6df14183560412e8878b7193860b4fbb3816b93e571af704
SSDEEP 768:4vw9816vhKQLroK4/wQzXOQ69zbjlAAX5e9zz:wEGh0oKlGizbR9Xwzz
TLSH
T1F4835CD38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe

Path C:\Windows\{CB0253AD-BA7B-40c8-A290-3C7A2094C204}.exe
Size 79KB
SHA256 e3800dc1e6d0970392ed79b66024778655ebc91a45ba64d8dfdb4dda3c4f8e32
MD5 48893311f1a7046a432de5a167ba6fbd
SHA1 23fedf59fdcea9917ddf0f0920427fc23f2e9c31
SHA512 9e4ee46c50c44f97520ea3926b5e5bdfcc8c9463f26fb72491a5d746682cf8d4ec5b3754615745f39fdc7bbdd91a44c2b43b01c579bed27ae048663a67d92a81
SSDEEP 768:4vw9816vhKQLrof4/wQzXOQ69zbjlAAX5e9zz:wEGh0oflGizbR9Xwzz
TLSH
T1FF835CD38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe

Path C:\Windows\{F317C3D9-3316-4618-A460-FA1CE73864BB}.exe
Size 79KB
SHA256 dfd147099f7bf99a32aeb393fa44fb31697fb7eac5c2874b1f64b77ad8fc6a4c
MD5 3a20380fb052293ce3047a4b893d83ce
SHA1 526f1a0462ea1e1a799f896c446adaa305eb1355
SHA512 650c286a5b5d8b4ba11ade95ea36cf2e8c88533fdc5e0155110fc643031b7350d9485932cf49f7e7aa75fc68d6e9d5f371e827e007a23638a15bab0333fd9c09
SSDEEP 768:4vw9816vhKQLroT4/wQzXOQ69zbjlAAX5e9zz:wEGh0oTlGizbR9Xwzz
TLSH
T11A835CD38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads